South African businesses are not ready for the looming implementation of the Protection of Personal Information (POPI) Act, auditing firm Grant Thornton said on Thursday.

The POPI Act, which was gazetted in December and currently awaited an effective date, required widespread reforms to be introduced by the private and public sectors to ensure that the personal data they collected was protected.

The Act also provided strict guidelines on what data could be obtained and how that data could be used, and required the data to be kept up to date.

“[However], there are many experts, such as information technology (IT) security consultants we deal with every day who say South Africa is not ready for POPI and that it is not going to work. They say even some of the big corporate players are at different levels of compliance or not ready to implement it at all,” Grant Thornton IT advisory director Michiel Jonker said.

One of the reasons for this was that South Africa did not have the "privacy culture" of some of the more developed countries, he said.

“We see all the time how passwords and the like go unprotected. Security cameras record personal information without securing permission or issuing a warning to those affected. The African continent as a whole is not geared for this level of privacy protection – we are in survival mode and some believe that we are, therefore, not in a space to implement this complex legislation yet,” Jonker explained.

Meanwhile, implementing the POPI Act would place significant cost pressures on big business owing to the extra layer of administration required, he pointed out.

In addition to the rising costs of doing business, companies would also be faced with the potential of multimillion-rand fines, civil claims and reputational damage, if they were found guilty of POPI transgressions.

“The introduction of POPI could lead to significant fines for companies found to have had data breaches,” Grant Thornton legal partner from Phukubje Pierce Masithela Attorneys Lucien Pierce said.

Big corporate organisations dealing with sensitive information would be most at risk in South Africa, Jonker said, explaining that they would have to prove to the regulatory body that they took appropriate steps to offset any potential data breaches.

“A [small] shop with a few customers may need to implement basic security, but a huge medical aid entity with thousands of members, dealing with very sensitive information, will need a much bigger team of specialists and advisers.

“Every business has to prove that they did what the ‘reasonable person’ would have done, considering financial constraints; the sensitivity of the data they collect, process and store; the industry standards and expectations; and best practices generally accepted by the international community,” Pierce stated.

However, the cost pressures notwithstanding, Jonker pointed out that the Act’s benefits in the long run could be positive, as the international business community preferred that South Africa had national personal privacy legislation in place before doing business.

“They are forced by their legislation to ensure that their business partners enforce similar privacy controls,” Jonker said.

Pierce stated that there were alternatives to legislation, such as binding corporate rules, but that the approval processes could be tedious.

“[Therefore], local dynamic organisations with significant future growth aspirations should see POPI as a business enabler or opportunity. It will eradicate even more barriers erected by international governments, [enabling] South African executives to successfully embark on doing business internationally,” he added.

However, opportunities that POPI created depended on how well South Africa’s public and private sectors could embrace a culture of privacy.

“Once the culture is right, all the other privacy measures will work. We need to start respecting the privacy of personal information. It starts with the tone of top management and filters to the mail room downstairs,” Jonker concluded.