Count the cloud tools your business uses. Email, CRM, accounting, payroll, e-signature, file storage, and the scheduling app someone signed up for on a free trial. Each one holds some of your clients’ personal information and some of your company’s. Now count how many of those vendors you’ve asked a single question about how they look after it.
If the second number is zero, you have plenty of company, and you’re still accountable.
POPIA leaves the responsibility with you
POPIA draws a clear line. You decide why client information is collected and what it’s used for, which makes you the responsible party. The software vendor processing it on your behalf is an operator. Handing over the data doesn’t hand over the accountability. If the vendor has a breach, you’re the one who answers to the Information Regulator and your clients.
It also covers more than individuals. POPIA protects information about companies as well as people, so your business clients’ details count.
There should be a written agreement
POPIA expects a written agreement between you and each operator that commits them to keeping the information secure. Look for it in your vendor’s terms. It may be called an operator agreement or a data processing addendum, and it may sit behind a link at the bottom of the terms you clicked through on day one. If you can’t find one, ask for it. A vendor that doesn’t know what you mean has answered a bigger question.
Find out where the data sits
Plenty of SaaS tools host their data in Europe or the US. That can be perfectly lawful, but POPIA puts conditions on sending personal information outside South Africa. For each tool, you should know where the data is hosted and which condition you’re relying on. If you’re not sure, ask your compliance officer or legal adviser.
Ask who at the vendor can see it
Somewhere at every vendor there are people with access to live customer data. Support staff, engineers and, at some vendors, an outsourced team in another country. Ask how many people have that access, how it’s granted and removed, and whether it’s logged. Ask which subcontractors also touch your data, from the hosting provider to the support desk software. A good vendor answers without fuss because the answers are already written down.
Ask what happens when something goes wrong
When there’s reason to believe personal information has been accessed by someone unauthorised, POPIA expects you to notify the Information Regulator and the people affected. Your vendor has to tell you when it happens on their side.
Your clock starts when the vendor tells you. Ask how they’d notify you, how quickly and who you’d hear from. Then ask when they last rehearsed it. Put their answer next to your own incident plan and check that the two fit.
Ask how you get your data back
This is the question people forget. If you leave, how do you get your data out, in what format, and when is it deleted from their systems and backups? Ask for a sample export now, while the relationship is good, and check that your team can open and use it. A vendor that makes leaving hard is holding more than your data.
Put the questions on one page
You don’t need a lawyer for every tool. Write the questions down once: operator agreement, hosting location, cross-border grounds, staff access, subcontractors, breach notification, exit and deletion. Send them to every vendor that holds client information, starting with the ones that hold the most. File the answers with your POPIA records and review them when the contract renews. Give one person the job of chasing the answers, or the list will sit in an inbox for months.
The vendors worth keeping will answer quickly and clearly. If you’re a Commspace client, send the list to us as well.
