MZIZI Compliance Bites

This article seeks to highlight three items that we consider to be important when it comes to #data compliance. It is based on the work that we are doing to support organisations implement or strengthen data compliance systems.  1. Apply the age-old #compliance frameworks when implementing data compliance.  The framework is tried and tested and provides a useful implementation framework that covers: - policies and procedures (including code of conduct and #ethics ), - effective #communication (hotline), - training, - compliance office (outsourced or in-house), - #audit and monitoring, - consequence/accountability management, and - third party transactions. You will note that registration with the Office of the Data Protection Commissioner (ODPC) is not listed as an element on its own. Registration is a necessary but not sufficient aspect of compliance. In fact, we consider registration, particularly the declarations made in that process, as exposing  organisations ...

  In early September of this year the headlines screamed various versions of "Facebook doesn't know where your data is, what it's engineers are doing with it." https://www.huffpost.com/entry/facebook-user-data_n_6318ff67e4b046aa0230a14e We clutched at our pearls in shock and horror. How could they?   But is Facebook's experience unique to them?  I do not think so. As you interact more intimately with the Kenyan Data Protection Act, 2019, you realise that this problem is not unique to Facebook. Many organisations do not know where their data is, or what it's constituents are doing with it. DPA,19 and Privacy by Design A major challenge with the DPA, 19 is that the government mandated a legislation without factoring the technical part, implemented by software and hardware engineers, as part of its transition.   There are resource implications of placing data protection and privacy at the centre of design.  Time, cost and technical expertise has to be factored in...