SA must renew education if tech ecosystem is to flourish

SA has to
lift education

If tech ecosystem
is to grow.

Thursday, Jun 21st

Africa's limited data protection laws heighten GDPR significance

Africa's limited data protection laws heighten GDPR significance

Businesses in Africa that have dealings with EU companies and regulate or share data, or deal with EU citizens residing in Africa, have to be aware of the implications of GDPR data protection legislation that comes into effect on 25 May 2018.

At the ITWeb Security Summit 2018 in Midrand, Johannesburg, data privacy expert Samantha Buchler and information/cyber security specialist Tiaan van Schalkwyk from Deloitte said the GDPR has 'an extra-territorial effect'.

This means that Africa's limited maturity regarding data protection legislation becomes all the more relevant.

"African organisations are not consistent across the continent regarding the levels of maturity from a data protection standpoint...a lot of countries on the continent have no data protection legislation whatsoever," said Buchler.

There are similarities between South Africa's Protection of Personal Information (PoPI) law and GDPR in terms of storage of personal information, access, manipulation and use.

Buchler explained that companies that believe themselves to be 100% PoPI-compliant would essentially be about 80% to 90% GDPR-compliant.

Van Schalkwyk and Buchler pointed out that GDPR includes a codified requirement for a data protection officer for companies with 200 or more employees.

"Whereas in PoPI, there is a requirement for this position for companies of any size," said Van Schalkwyk.

GDPR also covers data inventory extensively, with the premise being that businesses need to know exactly what personal information is being processed, "because you need to know exactly what it is you are protecting."

The GDPR pays particular attention to consent management, records of processing activities (and the consumer's 'right to be forgotten'), which have implications as far as the regulation of unsolicited marketing is concerned, or the right for consumers to demand a business/service/ organisation deletes their history and all personal information upon request.

Buchler said aspects like accountability and data portability have proven to be challenges impacting compliance.

According to the Deloitte Global GDPR Survey, only Germany and Austria have declared themselves to be GDPR-ready.

In an article titled There are no GDPR quick wins, author Gregg Petersen, regional vice president at Veeam, said despite the looming threat of penalties for non-compliance, a survey by international law firm Paul Hastings found that many top UK and US businesses are massively overestimating their GDPR readiness.

"As many as 94% of FTSE 350 and 98% of Fortune 500 companies believe they're on track to comply with the GDPR by 25 May 2018. And yet, the same report found that only 39% of UK and 47% of US businesses have set up an internal GDPR taskforce," Petersen said.

ALSO ON ITWEB AFRICA

Uganda 'feels' Tanzania's tightening grip on social media Published on 12 June 2018

Latest blog shutdown in Tanzania has triggered response from Uganda's ICT Association.

What are our partners up to? Published on 19 June 2018

Switzerland-based R&M, a Tank Industries partner, showcased their latest products at the Anga Com Conference in Cologne, Germany during the week of 12 to 14 June 2018.

MTN, Solution Space seek 10 digital entrepreneurs Published on 12 June 2018

Digital ventures are invited to participate in the Winter School Venture Incubation Programme which begins in September.