1. Protection of Personal Information (PoPI) Verushka Reddy and Rob MacMahon 20 August 2013

2. Processing personal information - broad definitions TermDefinition ProcessingTo receive, store and transmit PersonalPrivate to an entity or individual InformationData used to identify an individual

3. PoPI Conditions Accountability Processing limitation Purpose specification Further processing limitation Information quality Openness Security safeguards Data subject participation

4. Compliance with PoPI - Benefits and Risks AreaBenefitsRisks Sound processing processes Reliable data, increased automation Bad data, increased costs Robust technology Automation, security, accessibility, cost efficiency Expensive, manual Data quality Reflection of good processes and effectiveness of administrator, internal and external reporting Manual processing, increased costs Data securityCompliance, reduced risks Fraud and reputation risks Industry perceptionSafety, trustLack of trust CommunicationBetter, building trust, educationHaphazard, unclaimed

5. Cross border transfer of data ActionCompliance Why should we do this? Product / service enhances governance, service and / or reduce costs – this is why PoPI is here PoPI complianceAuthority built into individual data authority processes Compliance with Data LawsOf receiving country (UK, USA and Europe) Viewing data stored overseas PoPI gives 3 rd country equivalence Where it is storedUnderstand location (Cloud or hosted) Processing limitationsUnderstand what is being transferred and what for Access to dataBefore, during and after – Terms & Conditions Risk managementStability and accessibility

6. Outcomes and measures OutcomeMeasureAction Sound ProcessesEfficient administrationMap data flows Robust technology Uptime, automation, accessibility IT governance Efficient administrationData qualityMeasure data quality Good communicationTime to access information Driven by data quality and technology Company governance Board and Exco responsibility, liquidity Company structure, reporting Scheme governanceReporting processes SLAs, process and risk management