How directors can benefit as CIPC tightens data privacy loose ends

The Companies and Intellectual Property Commission (CIPC) is looking to align its practices with the country’s protection of information laws, in a move that might see it redact directors’ personal information available for public consumption.

The agency, tasked with registering businesses, co-operatives and intellectual property rights, is looking to rope in private sector expertise to mask the information at its disposal and, by extension, that of the public.

To this end, the agency has gone to market, seeking service providers who will help it operationalise data masking capabilities to enable it to achieve comprehensive compliance with the Protection of Personal Information Act (Popia).

“Despite CIPC’s compliance endeavours, the inadequate systematic data masking solution constitutes significant legal and operational exposure. A proactive solution is therefore imperative, not only to close the remaining compliance gaps but also to safeguard institutional integrity, enable secure service delivery, and align CIPC with global best practices in data privacy and protection,” the entity said in its request for proposal.

“The objective is to safeguard personally identifiable information (PII) across all external-facing digital platforms, internal operational systems, and legacy environments. In doing so, the Data Masking solution ensures alignment with the dual imperatives of protecting individual privacy rights and enabling lawful public access to information.

“The POPIA Implementation Plan identifies unmasked disclosures of PII, such as identity numbers, as the most material compliance risk, potentially exposing the commission to identity theft, corporate hijacking and significant legal liability.”

Some of the functional requirements the CIPC is looking for are a solution that will restrict access to personally identifiable information such as bank details and salary data.

However, the mask data will be available to law enforcement agencies, such as the police, Hawks and the National Prosecuting Authority when needed to advance live investigations.

The CIPC is also in the process of implementing a modernised open data portal to give data users an easy way to find and interact with its datasets.

The agency does not have an enterprise data management and governance solution in place and has again turned to the private sector to assist it with this solution via a tender process.

“The lack of an enterprise data management and governance solution has led to difficulty knowing what data the CIPC has, the nature/sensitivity of the data, the data quality, how it’s being used, who is using it, why it’s needed and whether it is trustworthy for reporting and other uses.

“Requests for new analytics initiatives are often challenging in the early stages of data discovery given there is no ability to search for data assets matching business criteria. A large amount of time goes into identifying and vetting potential data sources before any data integration work can begin.”