Independent schools hold information about learners, parents and staff. Retailers hold customer contact details, purchase histories and account information. Under the Protection of Personal Information Act, 2013 (POPIA), organisations that process personal information have responsibilities for how it is collected, used, stored and protected.
This article outlines practical considerations when managing personal information in business software. It is general information, not legal advice. Your organisation’s specific obligations depend on its role, processes and agreements, and should be assessed with a qualified professional where needed.
Collect only what you need
Before adding a field to a form or database, ask why you need it. Collecting less information reduces risk and makes records easier to keep accurate.
Be clear about purpose
People should understand why their information is being collected and how it will be used. Keep your privacy notices, consent wording and actual practices consistent.
Control who can access information
Not every staff member needs to see every record. Software should support user roles and permissions, so that:
- teachers see the learners they teach, not the whole school’s records;
- cashiers can capture sales without seeing full customer histories;
- financial information is limited to the people responsible for it.
Protect information with reasonable measures
POPIA requires responsible parties to take reasonable technical and organisational measures to protect personal information. In practice, questions to consider include:
- Is the system accessed over a secure connection?
- Are passwords and user accounts managed properly, including when staff leave?
- Are there regular backups, and have they been tested?
- Can you see who changed important records?
Keep information accurate and up to date
Outdated contact details cause missed messages and wrong decisions. A single, shared record is easier to keep accurate than several spreadsheets.
Decide how long to keep information
Agree retention periods for different types of records, and remove or de-identify information that is no longer needed, unless the law requires you to keep it.
Understand where information is stored
Know where your system is hosted and which service providers handle your data. Agreements with providers should reflect your responsibilities.
Use fictional data for demonstrations and testing
When evaluating or testing software, use fictional records rather than real learner or customer information.
How Worksolutions approaches this
We design systems with privacy, access control, secure handling and responsible data management in mind. POPIA responsibilities depend on each organisation’s role, processes, agreements and implementation environment, so requirements are assessed for each project.
To discuss data and access requirements for your organisation, explore our school and retail solutions or send us an enquiry.
