POPIA Compliance Policy &
Incident Response Protocol

1.1 Hein Wagner Academy NPC (“the Academy”) is an educational non-profit organization providing specialized training, skills development, and hosting facilities for visually impaired and other learners.

1.2 The Academy is committed to protecting the privacy, confidentiality, and integrity of all personal information processed in the performance of its educational and administrative functions.

1.3 This Policy implements the statutory requirements of the Protection of Personal Information Act 4 of 2013 (“POPIA”), establishing institutional standards for collecting, holding, sharing, retaining, and securely destroying personal and special personal information.

2.1 This Policy applies to all directors, staff members, lecturers, administrative personnel, contractors, and students across all Academy operations and facilities.

2.2 Designated Institutional Officers:

2.3 The appointment of a Deputy Information Officer remains under active institutional consideration.

4.1 In the interpretation of this Policy, unless the context clearly indicates a contrary intention:

4.2 This Policy forms an integral part of the Academy's overall governance framework and must be read and considered in conjunction with other institutional policies as inter alia set out in the Acceptable Use Policy, including:

4.3 Where any conflict, inconsistency or contradiction arises between the provisions of this POPIA Compliance Policy and any other institutional policy, protocol or guideline regarding matters pertaining to Personal Information, Special Personal Information or data protection, the provisions of this POPIA Compliance Policy shall prevail and supersede such other policy, protocol or guideline, unless such other provision contained elsewhere provides a better and more secure mechanism for the protection of Personal Information, in which event such other provision shall prevail.

6.1 Pursuant to POPIA Condition 3 (Purpose Specification), the Academy processes personal information across five primary operational categories:

6.2 These five primary categories do not constitute a closed list, and the Academy acknowledges that the Processing of information that does not fall within any of these five defined categories may only take place for a specific and defined purpose.

7.1 Student medical files, disability assessments, and visual impairment diagnostic records are classified as Special Personal Information under Section 26 of POPIA. Processing is conducted under the explicit statutory exceptions of Section 27, based on data subject or guardian consent and the institutional obligation to secure disability benefits.

7.2 Storage and Access for TVET College Student Health Records: Digital health records for TVET College students are saved securely on the Information Officer's OneDrive. Hardcopy health records are kept in a locked cabinet in Corné du Bois's office. This information is shared exclusively with NSFAS, Boland College, and the Department of Higher Education and Training (DHET) for the processing of student disability benefits.

7.3 Storage and Access for Cyber Security Student Health Records: Digital health records for Cyber Security students are saved securely on the Information Officer's OneDrive. Hardcopy health records are kept in a locked cabinet in the Information Officer's office. This information is shared exclusively with ABSA (as corporate sponsor), ICITP, and relevant SETAs for the processing of student disability benefits and sponsorship administration.

7.4 Special personal information may not be disclosed to any third party not explicitly authorized above without prior written authorization from the Information Officer or competent person consent.

8.1 Pursuant to Section 14 of POPIA, personal records must be retained only for as long as necessary to fulfill operational purposes or legal obligations.

8.2 Financial & SARS Records: As the Academy was established approximately eight years ago, all historical financial records are retained. All old invoices and accounting records are securely stored in a walk-in safe.

8.3 Personnel & Donor Records: All employee human resources records and donor details are currently maintained in locked cabinets in the Information Officer's office. Employee files are retained for the duration of employment plus three years pursuant to applicable labour legislation. Donor records are retained for the duration of the active relationship plus five years for NPO auditing compliance.

8.4 Student & Alumni Records (Special Exception): Student files are managed under a specific operational exception. Due to socioeconomic circumstances, many visually impaired students do not have reliable personal storage for their original documentation, making the Academy the primary repository for copies of their matric certificates and qualifications. Alumni documents are safeguarded in a walk-in safe for permanent custody.

8.5 Destruction & De-identification Protocols: Routine disposal of individual hardcopy pages is executed on-site by tearing documents into unreadable strips. Bulk historical financial and SARS document disposal is executed through an accredited third-party shredding service. Operational digital file deletions are performed by authorized personnel, while permanent server purges and system de-identifications are managed by the IT Manager.

9.1 Clean Desk Policy: All staff and students must comply with physical data security rules. Physical files containing personal information must be stored in locked filing cabinets or the walk-in safe when unattended. Computer screens must be locked (Windows Key + L) whenever a user steps away from a workstation.

9.2 Institutional Messaging Protocol: Staff members may only make use of a designated, official WhatsApp Business account of the Hein Wagner Academy to communicate with prospective or enrolled students, or prospective or active donors. Staff are strictly prohibited from using personal WhatsApp accounts or unapproved channels to contact individuals or collect personal information. Intake details collected via WhatsApp Business must immediately be transferred to the Academy's secure server or Microsoft 365 environment.

9.3 AI Tools & Data Protection: Staff and students may use Microsoft 365 Copilot within the secure institutional tenant. Entering personal information, health records, or employee details into public AI chatbots (such as ChatGPT, Gemini, or Claude) is strictly prohibited.

9.4 Direct Marketing Stance: The Academy does not currently send electronic newsletters or conduct direct electronic marketing campaigns. Any future direct marketing must strictly comply with Section 69 of POPIA, requiring opt-in consent for non-customers and functional unsubscribe mechanisms on all communications.

10.1 Pursuant to Section 22 of POPIA, the Academy enforces a five-stage protocol upon suspecting or discovering a security compromise or personal data breach:

1. 10.1.1
   Stage 1 — Identification & EscalationAny staff member, contractor, or student who detects a lost device, unauthorized system access, phishing breach, missing physical file, or clean desk exposure must report the incident within two hours to the IT Manager ([email protected]) and Information Officer ([email protected]).
2. 10.1.2
   Stage 2 — Immediate Containment & RemediationThe IT Manager must isolate affected network segments, revoke compromised user credentials, apply security patches, or initiate remote device wipes. Physical security breaches, such as missing keys or compromised locks, require immediate physical containment and lock replacement.
3. 10.1.3
   Stage 3 — Risk AssessmentThe Information Officer, supported by technical and legal advisors, must evaluate the nature and scope of data exposed, assess the risk of identity fraud or financial loss to data subjects, and determine whether affected records were adequately encrypted or de-identified.
4. 10.1.4
   Stage 4 — Mandatory Statutory Notifications (POPIA Section 22)Where reasonable grounds exist to believe personal information was accessed by an unauthorized person, the Information Officer must notify the Information Regulator in writing as soon as reasonably possible. Written notification must also be issued to affected data subjects, detailing the breach consequences, mitigation measures taken, recommended user actions, and Information Officer contact details.
5. 10.1.5
   Stage 5 — Post-Incident Governance & ReportingThe Information Officer must record the incident in the Academy POPIA Register, conduct a forensic root-cause analysis, and strengthen security controls to prevent recurrence.

10.2 The Academy's POPIA Register may be maintained either electronically or in hardcopy format. Any incident or suspected breach recorded therein in accordance with clause 10.1.5 (Step 5) above shall reflect the date on which the incident occurred and/or the suspected breach was reported or discovered, the identity of the person by whom it was reported or discovered, and the manner in which the Academy addressed and dealt with the incident in accordance with the five-step process set out hereinabove.

11.1 Data subjects retain statutory rights to request access to, correction of, or deletion of their personal information maintained by the Academy under Section 23 and Section 24 of POPIA.

11.2 Access requests must be submitted using Form 2 of the POPIA Regulations to the Information Officer. Requests regarding official institutional records are processed in alignment with the Academy's PAIA Manual.

12.1 General Data Protection Regulation (GDPR) Overview: The General Data Protection Regulation (EU) 2016/679 (“GDPR”) is the comprehensive data privacy and protection regulation of the European Union. It regulates the processing of personal data relating to individuals (“data subjects”) within the European Economic Area (EEA), as well as the extraterritorial transfer and processing of EU residents' personal data by entities operating outside the EU. The GDPR mandates strict principles regarding lawful processing, data minimization, transparency, data subject rights, security safeguards, and legal mechanisms for cross-border data transfers.

12.2 Alignment Between POPIA and the GDPR: Although the Academy operates primarily within South Africa under POPIA, its processing operations and data protection standards align directly with the provisions and core principles of the GDPR for the following legal and structural reasons:

13.1 This POPIA Compliance Policy and Incident Response Plan shall be formally reviewed at least annually by the Information Officer and IT Manager.

13.2 Interim reviews shall be conducted immediately upon:

14.1 Notwithstanding any institutional governance process or any provision to the contrary contained in this Policy or any other institutional policy, the Information Officer shall have delegated authority and exclusive operational responsibility for reviewing, updating, amending and formally approving this Policy at least annually, or alternatively, as and when the need arises.

14.2 Any proposed amendment shall undergo a formal compliance review by the Information Officer, in consultation with technical and/or legal advisers where necessary, and shall take effect upon the Information Officer's formal approval and sign-off, without requiring prior submission to, or ratification by, the Board of Directors.

14.3 Following any material amendment approved by the Information Officer pursuant to this Policy, a copy of the revised Policy shall be tabled before the Chief Executive Officer and the Board of Directors at their next scheduled meeting for noting and alignment with the Academy's broader operational governance framework.

14.4 Amendments to this Policy may be initiated by the Information Officer as operational, technical, legislative or regulatory requirements dictate and shall not be subject to unnecessarily rigid committee procedures, formal institutional notices or third-party advisory involvement, unless such procedures, notices or involvement are required by applicable law or considered necessary by the Information Officer in the circumstances.

14.5 The Information Officer retains exclusive operational authority to adjust, update, amend or rewrite any provision of this Policy ex officio, provided that any material amendment is documented in writing and brought to the attention of all affected parties as soon as reasonably practicable thereafter.

15.1 This Policy is formally adopted and shall come into effect upon signature by the Information Officer, subject to the requirement that the Policy be brought to the attention of all affected parties as soon as reasonably practicable thereafter.

15.2 Notwithstanding the date on which this Policy is formally adopted and signed, it is acknowledged and recorded that the Academy has at all relevant times recognised and remained aware of its statutory obligations under POPIA since the commencement of the Act and has, prior to the formal adoption of this written Policy, taken reasonable, practical and good-faith measures aimed at ensuring compliance with its obligations under POPIA.

15.3 The Academy's compliance history shall accordingly be considered in the context of the measures and controls implemented by it prior to the formal adoption of this written Policy, including the registration of the Academy's Information Officer with the Information Regulator on a date preceding the signature and formal adoption of this Policy.

16.1 Institutional training on this Policy and general POPIA awareness shall, as far as reasonably practicable, be conducted in a practical and accessible manner on an ongoing basis. Such training may be integrated into general staff meetings, student orientation sessions, onboarding processes and other appropriate institutional activities, and may be supplemented by concise digital briefings or other appropriate awareness materials.

16.2 Newly appointed staff members and newly enrolled students shall receive an appropriate POPIA briefing and/or a copy of this Policy as part of the Academy's standard onboarding or administrative intake processes. Alternatively, they shall be informed that a copy of this Policy is available on the Academy's designated digital storage platforms, thereby enabling them to familiarise themselves with its contents and the obligations applicable to them.