Data Protection & Privacy
Every organisation holds other people's lives in its systems. The law asks it to act like it.
Names, ID numbers, salaries, medical notes, payment details. Nearly every organisation keeps this kind of information about its staff, members and customers, and data protection law says plainly what must be done with it: collect only what you need, use it for the purpose you gave, keep it safe, and let people see and correct what you hold.
The principle is much the same everywhere, and each country writes the rules into its own law. South Africa has the Protection of Personal Information Act and the Information Regulator. Botswana has its Data Protection Act, Kenya has its Data Protection Act and a Data Protection Commissioner, and the European Union has the General Data Protection Regulation, enforced by a supervisory authority in each member state. Most of these expect reasonable safeguards, a clear line of accountability for how personal information is handled, and notice to the regulator when a serious breach occurs.
Most failures begin with ordinary habits: a spreadsheet emailed to the wrong person, a laptop left unlocked, a supplier who was never asked how they protect the data. This theme is about making those habits good ones, wherever the organisation operates.
Data protection and information officers, directors and trustees, HR, and anyone who handles other people's details.