Context and overview

1) Introduction

Axon Lab South Africa (Pty) Ltd. needs to gather and use certain information about individuals.

These can include customers, suppliers, business contacts, employees, and other people the organisation has a relationship with or may need to contact.

This policy describes how this personal information (PI) must be stored to meet the company’s personal information protection standards and to comply with the law.

2) Definitions

a) PoPIA
Protection of Personal Information Act of 2013

b) PI
Personal Information

c) Company
Refers in this context to Axon Lab South Africa (Pty) Ltd.

3) Why this policy exists

This personal information protection policy ensures Axon Lab South Africa (Pty) Ltd.:

a) Complies with PI protection law and follow good practice
b) Protects the rights of staff, customers and partners
c) Is open about how it stores and processes individuals’ and juristic persons’ PI
d) Protects itself from the risks of a data breach

4) Personal Information protection law

The PoPIA 2013 (Protection of Personal Information Act of 2013) describes how organisations — including Axon Lab South Africa (Pty) Ltd. — must collect, handle and store personal information.

These rules apply regardless of whether PI is stored electronically, on paper or on other materials.

To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.

The PoPIA is underpinned by eight important principles. These say that personal information must:

• • • Principle 1: Accountability
      This principle contemplates the assigning of responsibility by organisations for overseeing compliance with the Bill.

• Principle 2: Processing Limitation
  This principle requires that personal information may only be processed in a fair and lawful manner.
  
  
• Principle 3: Purpose Specification
  The principle of Purpose Specification helps to determine the scope within which personal information may be processed by an organisation.
  
  
• Principle 4: Further Processing Limitation
  Once an organisation has identified and obtained consent for specific, legitimate, and explicitly defined purposes, the processing of such personal information may only occur insofar as it is necessary for the fulfilment of those purposes.
  
  
• Principle 5: Information Quality
  Clause 16 of the Bill sets out, in general terms, the responsibility of organisations to ensure and maintain the quality of the personal information that they process.
  
  
• Principle 6: Openness
  The sixth principle of “Openness” is linked directly to an organisation’s duty to process information in a fair and transparent manner.
  
  
• Principle 7: Security Safeguards
  The underlying theme of Principle 7 is that all personal information should be kept secure against the risk of loss, unauthorised access, interference, modification, destruction or disclosure.
  
  
• Principle 8: Data Subject Participation
  Principle 8 empowers individuals to access and/or request the correction or deletion of any personal information held about them that may be inaccurate, misleading or outdated.

5) People, risks and responsibilities

a) Policy scope

This policy applies to:

i) The head office of Axon Lab South Africa (Pty) Ltd.
ii) All branches of Axon Lab South Africa (Pty) Ltd.
iii) All subsidiaries of Axon Lab South Africa (Pty) Ltd.
iv) All staff and volunteers of Axon Lab South Africa (Pty) Ltd.
v) All contractors, agents and other people working on behalf of Axon Lab South Africa (Pty) Ltd.

It applies to all data that the company holds relating to identifiable individuals and juristic persons. This can include:

vi) Names of individuals
vii) Postal addresses of individuals
viii) Email addresses of individuals
ix) Telephone numbers of individuals
x) …plus any other information relating to individuals

b) Personal Information Protection risks

This policy helps to protect Axon Lab South Africa (Pty) Ltd. from some very real data security risks, including:

i) Breaches of confidentiality. For instance, personal information being given out inappropriately.
ii) Failing to offer choice. For instance, all individuals should be free to choose how the company uses personal information relating to them.
iii) Reputational damage. For instance, the company could suffer if hackers successfully gained access to sensitive data.

c) Responsibilities

Everyone who works for or with Axon Lab South Africa (Pty) Ltd. has some responsibility for ensuring personal information is collected, stored and handled appropriately.

Each team or individual that handles personal information must ensure that it is handled and processed in line with this policy and PI protection principles.

However, these people have key areas of responsibility:

i) The board of directors is ultimately responsible for ensuring that Axon Lab South Africa (Pty) Ltd. meets its legal obligations.

ii) The Information Officer, Greg Northfield, is responsible for:

a) Keeping the board updated about PI protection responsibilities, risks and issues.
b) Reviewing all PI protection procedures and related policies, in line with an agreed schedule.
c) Arranging PI protection training and advice for the people covered by this policy.
d) Handling PI protection questions from staff and anyone else covered by this policy.
e) Dealing with requests from individuals to see the personal information Axon Lab South Africa (Pty) Ltd. holds about them (also called ‘data subject access requests’).
f) Checking and approving any contracts or agreements with third parties that may handle the company’s sensitive data.

iii) The IT manager and Deputy Information Officer, Donovan Burger, is responsible for:

a) Ensuring all systems, services and equipment used for storing personal information meet acceptable security standards.
b) Performing regular checks and scans to ensure security hardware and software is functioning properly.
c) Evaluating any third-party services the company is considering using to store or process personal information. For instance, cloud computing services.

iv) The Marketing manager, Triolan Pillay, is responsible for:

a) Approving any PI protection statements attached to communications such as emails and letters.
b) Where necessary, working with other staff to ensure marketing initiatives abide by PI protection principles.

6) General staff guidelines

i) Personal information should not be shared informally. When access to confidential information is required, employees can request it from their line managers.
ii) Axon Lab South Africa (Pty) Ltd. will provide training to all employees to help them understand their responsibilities when handling personal info.
iii) Employees shall keep all personal information secure, by taking sensible precautions and following the guidelines below.
iv) In particular, strong passwords must be used and they should never be shared. Criteria for a strong password are:

a) Password has to be at least 8 characters in length
b) Password has to contain at least one capital letter
c) Password has to contain at least one special character (!,@,#,%,$,^,&,*)
d) Password has to contain at least one number

v) Personal information shall not be disclosed to unauthorised people, either within the company or externally.
vi) Personal information should be regularly reviewed and updated if it is found to be out of date. If no longer required, it should be deleted and disposed of.
vii) Employees should request help from their line manager or the Information Officer if they are unsure about any aspect of personal information protection.

7) Personal Information Storage

These rules describe how and where PI should be safely stored. Questions about storing information safely can be directed to the IT manager or anyone on the PoPIA Committee.

When PI is stored on paper, it should be kept in a secure place where unauthorised people cannot see it. These guidelines also apply to information that is usually stored electronically but has been printed out for some reason:

i) When not required, the paper or files should be kept in a locked drawer, behind a locked office door, or locked in a filing cabinet.
ii) Employees should make sure paper and printouts containing PI are not left where unauthorised people could see them, like on a printer or left on their desks unsupervised.
iii) Printouts containing PI should be shredded when no longer required.

When PI is stored electronically, it must be protected from unauthorised access, accidental deletion and malicious hacking attempts:

iv) Information should be protected by strong passwords that are changed regularly and never shared between employees.
v) If PI is stored on removable media (like a CD or DVD external HDD or thumb drive), these should be encrypted and kept locked away securely when not being used.
vi) Personal information should only be stored on designated drives and servers and should only be uploaded to approved cloud computing services.
vii) Servers containing personal information should be sited in a secure location, away from general office space.
viii) Personal information should be backed up frequently. Those backups should be tested regularly, in line with the company’s standard backup procedures.
ix) All servers containing personal information should be protected by strong passwords, and a firewall.
x) All computers containing PI should be protected by strong passwords and their Hard Drives need to be encrypted, eg. BitLocker for Microsoft Windows-based systems or by File Vault for MacBook / MacOS-based systems.
xi) All smartphones and handheld devices containing PI should be protected using either a password, PIN code, or any other biometrics-related security as found on these devices.

8) Personal Information use

Personal information is of no value to Axon Lab South Africa (Pty) Ltd. unless the business can make use of it. However, it is when personal information is processed that it can be at the greatest risk of loss, corruption or theft:

i) When working with personal information, employees should ensure the screens of their computers are always locked when left unattended.
ii) Personal information should not be shared informally.
iii) Personal information must be encrypted before being transferred.

9) Personal Information Accuracy

The law requires Axon Lab South Africa (Pty) Ltd. to take reasonable steps to ensure PI is kept accurate and up to date.

It is the responsibility of all employees who work with PI to take reasonable steps to ensure it is kept as accurate and up to date as possible.

i) PI will be held in as few places as necessary. Staff shall not create any unnecessary additional copies.
ii) Staff should take every opportunity to ensure PI is updated.
iii) PI should be updated as inaccuracies are discovered. For instance, if a customer can no longer be reached on their stored telephone number, it should be removed from the database.

10) Data subject access requests

All individuals who are the subject of personal info held by Axon Lab South Africa (Pty) Ltd. are entitled to:

i) Ask what information the company holds about them and why.
ii) Ask how to gain access to it.
iii) Be informed how to keep it up to date.
iv) Be informed how the company is meeting its PI protection obligations. If an individual contacts the company requesting this information, this is called a data subject access request.

Data subject access requests from individuals should be made by email, addressed to the Information Officer. The Information Officer can supply a standard request form.

The Information Officer will aim to provide the relevant data within 14 days.

The Information Officer will always verify the identity of anyone making a data subject access request before handing over any information.

11) Disclosing data for other reasons

In certain circumstances, the PoPIA allows personal information to be disclosed to law enforcement agencies without the consent of the data subject.

Under these circumstances, Axon Lab South Africa (Pty) Ltd. will disclose requested personal information. However, the Information Officer will ensure the request is legitimate, seeking assistance from the Board of Directors and from the company’s legal advisers where necessary.

12) Providing information

Axon Lab South Africa (Pty) Ltd. aims to ensure that individuals are aware that their data is being processed, and that they understand:

i) How the data is being used
ii) How to exercise their rights

To these ends, the company has a privacy statement, setting out how PI relating to data subjects is used by the company.