In today’s work data is the new currency, it’s important to stay up to date and comply with all existing and new laws put into place to protect data. One of the departments in any organisation that needs to pay attention to the Protection of Personal Information Act (POPIA) is marketing. Ensuring that all marketing campaigns are complying to all legal regulations.
What is POPIA?
POPIA protects all personal information of South African people and organisations by regulating how client data is used and stored.
Below is a list of the information governed by the POPI Act that you are likely using in your direct marketing, which includes but is not limited to:
- Gender
- Age
- Religion
- Culture
- Languages
- Email address
- Telephone number
- Physical address and location
- Personal opinions, views and preferences
Implications of POPIA non-compliance
Non-conformance to POPIA could lead to hefty fines and even legal litigation of your organisation. Ensuring compliance is imprimitive for all organisations across departments.
How does POPIA impact your organisation?
The purpose of POPIA is to ensure the personal data your organisation has access to is adequately secured and captured with consent. This could have a big impact on your sales and marketing departments as cold emailing and calling is now officially of the past.
Email marketing and POPIA
When it comes to email marketing, no organisation will be able to email anyone without that person giving explicit confirmation that you are allowed to email them.
Opt-ins and consent
Before POPIA, you were able to send emails to anyone who had filled out a form on your website. Now you won’t be able to hide your communication policy in your privacy policy or have pre-ticked opt-in forms either.
New subscribers must explicitly take action on a second verification to opt-in to your newsletter or database if you want to be able to keep marketing to them. You will also need to be specific about the channels you’re using to send marketing communication (e.g. cookies, emails, Instagram etc.)
Ensuring data protection
Complying to POPIA regulations requires a proactive approach. There are various steps you can take to ensure that the personal information your organisation collects is secure and protected.
1. The data protection impact assessment (DPIA)
One of your first steps should be to conduct a Data Protection Impact Assessment (DPIA) which is a systematic process assessing the nature, scope, context, and purposes of your data processing activities. The goal is to evaluate their impact on the individual’s privacy rights. Conducting a DPIA will allow you to identify potential risks and implement appropriate measures to prevent them.
2. Implementing data protection measures in your digital marketing
When complying to the new POPIA legislation, it’s important to implement secure data collection mechanisms, such as:
- Encrypted forms
- Secure payment gateways
- Collecting only necessary information
- Using information only for intended purposes
- Retaining information for only as long as necessary.
All of these processes protect personal information during the collection process.
3. Consent and opt-ins for data collection and processing
Before your organisation is allowed to collect, process, and store any personal information, informed and voluntary consent is required. You must provide information that is easy to understand on how their data will be used and they must consent willingly.
4. Data storage and security in digital marketing
How your organisation stores data will play a critical role in ensuring data protection. Your organisation would have to prioritise implementing the appropriate technical and organisational controls and measures that protect personal information from loss, theft and unauthorised access.
Implementing proactive systems to secure your data is imperative including regularly backing up data, encrypting sensitive information, updating security measures, conducting vulnerability, and providing awareness training for employees.
5. Providing POPIA training to employees
To ensure your organisation stays POPIA compliant, it’s essential that all employees receive ongoing awareness training on the principles and requirements of POPIA. Awareness training will ensure all employees do their part in protecting personal data collected and ensure the correct processes are followed when collecting and storing the information.
The WWISE Training Hub for POPIA training
At WWISE, we provide comprehensive POPIA training which includes training on data protection, privacy rights, and the organisation’s data protection policies and procedures.
Our POPIA Training programs include:
Training enables all employees, especially in your marketing department, to understand their responsibilities and actively contribute to data protection efforts.
If your marketing professionals require POPIA training, reach out to one of our experts on 012 644 0142 or send us an email on admin@wwise.co.za and we’ll be in touch with you.