Be Decisive About Data Disasters

Financial technology companies have clear responsibilities towards their clients and investors when information is leaked

- Karl Blom

The rise of the financial technology, or FinTech, industry may herald a significant upheaval to the financial services industry, and significant opportunities (and risks) await those who wish to participate. Novel data-processing techniques are a key aspect of many FinTech businesses and with such a rapid pace of innovation, there is an associated rise in the risk of data breaches. It is vital for such companies to be aware of their obligations in the event of a data breach.

Data and duty

The Protection of Information Act, 2013 (POPI) requires you to secure the integrity and confidentiality of personal information to prevent unlawful access to personal information, and to follow the prescribed notification procedures in the event of a data breach.

If there are ‘reasonable grounds’ to believe that the personal information of a data subject (this may include clients, suppliers or employees) has been compromised, the responsible party, or whoever determines the purpose and means of processing personal information, will need to immediately notify the Information Regulator and, unless directed otherwise, the affected data subjects.