Almost every business document contains personal information: supplier contacts, employee files, customer ID copies, delivery signatures. The Protection of Personal Information Act (POPIA) sets out how that information must be handled, and your document management system is where most of those rules are either met or broken.
This is a practical overview, not legal advice. Your legal adviser or information officer should confirm how POPIA applies to your organisation.
The eight conditions, in brief
POPIA sets eight conditions for lawful processing of personal information:
- Accountability
- Processing limitation
- Purpose specification
- Further processing limitation
- Information quality
- Openness
- Security safeguards
- Data subject participation
Three of them have a direct impact on how documents are stored and managed: purpose specification (which includes retention), security safeguards, and data subject participation.
Retention: do not keep records longer than needed
Section 14 of POPIA says records of personal information must not be kept longer than necessary for the purpose they were collected for. There are exceptions, for example when another law requires you to keep the record, when you reasonably need it for your lawful functions, when a contract requires it, or when the person has consented.
In practice that means your system should:
- Classify each document by type, such as invoice, employee file or contract
- Apply a retention period to each type, based on your own policy
- Flag records when the retention period ends, so they can be reviewed and destroyed or de identified
- Keep a record of what was destroyed and when
Shared drives cannot do this. A document management system with retention rules can.
Security safeguards: control who sees what
Section 19 requires appropriate, reasonable technical and organisational measures to prevent loss, damage or unauthorised access to personal information. For a document system, the basics are:
- Role based access. People only see the documents their role needs.
- An audit trail. Every view, change, download and approval is recorded with the person and the time.
- Encryption of documents in transit and at rest.
- Secure sharing. External parties get secure links rather than email attachments.
Data subject participation: be able to find it
People have the right to ask what personal information you hold about them and to ask for corrections. If their information is spread across inboxes, shared drives and paper files, answering that request is slow and incomplete. Full text search across one system turns it into a short task.
Information quality: one version of the truth
POPIA also expects personal information to be complete, accurate and up to date. Version control and a single place for each record make that achievable.
A quick checklist
Ask these questions of your current setup:
- Can you say how long each type of document is kept, and does the system enforce it?
- Can you show who opened a specific employee file last month?
- Can you find every document about one person within minutes?
- Do suppliers and clients receive documents by secure link or by email attachment?
If any answer is no, that is where to start.
How BCM Transform approaches it
The platforms BCM Transform builds on DocMGT are POPIA aligned by default: role based access, audit logging, encryption in transit and at rest, and records retention configured to each organisation's own policy.
See workflow and document management or book a free consultation.
SW van Wyk
CEO
SW van Wyk leads BCM Transform, the DocMGT distribution partner for Africa.