العودة إلى User Guides
المحتويات
User Guides
883 كلمة
Nov 13, 2026

Heratio Help Center article. Category: Compliance.

Privacy Compliance

User Guide

Manage data protection compliance for POPIA, GDPR, PIPEDA, CCPA, and other privacy regulations.

Workflow Overview

ConfigureRecordRespondReportSettingsActivitiesRequestsComplianceJurisdictionsROPADSARsDashboardOfficersConsentBreachesAuditTrail

Supported Jurisdictions

PRIVACYREGULATIONS🌍AFRICA🇿🇦POPIA-SouthAfrica(2021)🇳🇬NDPA-Nigeria(2023)🇰🇪DPA-Kenya(2019)🌍EUROPE🇪🇺GDPR-EuropeanUnion(2018)🌎NORTHAMERICA🇨🇦PIPEDA-Canada(2000)🇺🇸CCPA-California,USA(2020)

Key Requirements by Jurisdiction

REQUIREMENTPOPIAGDPRPIPEDACCPANDPADSARResponseDays3030304530BreachNotifyHrs7272ASAP7272DPO/IORequiredYesSomeNoNoYesConsentRecordsYesYesYesYesYesROPARequiredYesYesNoNoYesCross-borderRulesYesYesYesYesYes

How to Access

MainMenuAdminPrivacyComplianceDashboard(overviewandstats)Configuration(jurisdictionsettings)DSARRequests(datasubjectrequests)BreachRegister(incidenttracking)ROPA(processingactivities)ConsentRecords(consentmanagement)InformationOfficers(DPO/IOmanagement)

Part 1: Configuration

Enable Jurisdictions

JURISDICTIONCONFIGURATIONSelectjurisdictionsthatapplytoyourorganisation:☑🇿🇦POPIA(SouthAfrica)Responsedeadline:[30]daysBreachnotification:[72]hours☐🇪🇺GDPR(EuropeanUnion)Responsedeadline:[30]daysBreachnotification:[72]hours☐🇨🇦PIPEDA(Canada)Responsedeadline:[30]daysBreachnotification:[Assoonaspossible]☐🇺🇸CCPA(California)Responsedeadline:[45]daysBreachnotification:[72]hours[SaveConfiguration]

Organisation Settings

ORGANISATIONDETAILSOrganisationName*[TheArchiveMuseum____________]RegistrationNumber[2020/123456/07_______________]DataProtectionEmail[privacy@archive.org.za_______]PhysicalAddress[123HeritageStreet__________][Pretoria,0001_______________]DefaultRetention[7]years[SaveSettings]

Part 2: Information Officers

What is an Information Officer?

POPIA:InformationOfficer(IO)GDPR:DataProtectionOfficer(DPO)NDPA:DataProtectionOfficer(DPO)Responsibilities:•Handledatasubjectrequests•Reportbreachestoregulator•Ensurecompliancewithregulations•Conductprivacyimpactassessments•TrainstaffondataprotectionPOPIArequiresregistrationwithInformationRegulator

Register Information Officer

ADDINFORMATIONOFFICERName*[JaneSmith___________________]Position*[RecordsManager______________]Email*[jane.smith@archive.org.za____]Phone[0123456789_________________]Jurisdiction*[POPIA]RegistrationStatus[Registered]PendingRegisteredExpiredRegistrationNumber[IO/2024/12345________________]RegistrationDate[15/03/2024📅][Cancel][SaveOfficer]

Part 3: DSAR Management

What is a DSAR?

DSAR=DataSubjectAccessRequestAperson'srightto:•Knowwhatpersonaldatayouholdaboutthem•Getacopyoftheirdata•Haveincorrectdatacorrected•Havedatadeleted(righttoerasure)•Objecttoprocessing•DataportabilityYOUMUSTRESPONDWITHINTHEDEADLINE:•POPIA/GDPR/NDPA:30days•CCPA:45days

DSAR Workflow

RequestReceivedVerifyIdentity(Isthisreallythedatasubject?)VerifiedNotVerifiedSearchforRequestmorepersonaldatainformationCompileresponseDataFoundNoDataProvideInformdatasubjectCOMPLETELogoutcome

Log New DSAR

NEWDATASUBJECTACCESSREQUESTRequestDate*[10/01/2026📅]Jurisdiction*[POPIA]DueDate[09/02/2026](auto-calculated)RequestType*[Access]AccessCorrectionDeletionObjectionPortabilityDATASUBJECTDETAILSName*[JohnDoe_____________________]Email*[john.doe@example.com_________]Phone[0821234567_________________]IDVerified?○Yes●No○PendingREQUESTDETAILSDescription:[Requestingcopyofallpersonaldataheldinarchive][records.Specificallyinterestedinemploymentrecords.]Attachments:[📎IDCopy.pdf][📎RequestForm][Cancel][LogRequest]

DSAR Dashboard

DSARREQUESTSOPENDUESOONOVERDUE(7days)831requestsrequestsrequest⚠️🔴IDSubjectTypeDueDateStatusDSR-001JohnDoeAccess09Feb26🟡InProgressDSR-002JaneSmithDeletion15Feb26🟡InProgressDSR-003BobWilsonAccess🔴02Jan26🔴OverdueDSR-004MaryJonesCorrect20Feb26🟢New[NewRequest][Export][Filter]

Part 4: Breach Management

What is a Data Breach?

BREACH=Unauthorisedaccess,loss,ordisclosureofpersonalinformationExamples:•Cyberattack/hacking•Lostorstolendevicewithdata•Emailsenttowrongrecipient•Unauthorisedemployeeaccess•Physicaltheftofrecords•AccidentalpublicationofdataYOUMUST:1.Reporttoregulatorwithin72hours(usually)2.Notifyaffectedindividualsifriskofharm3.Documenttheincidentandresponse

Breach Response Workflow

BreachDiscoveredCONTAINStopthebreachASSESS•Whatdata?•Howmany?•Whatrisk?HighRiskLowRiskNOTIFYDOCUMENT•Regulator•Logonly(72hrs)•Monitor•SubjectsREMEDIATEFixcausePreventrecurrenceREVIEWLessonslearned

Log Data Breach

REPORTDATABREACHIncidentDate*[08/01/2026📅]at[14:30]DiscoveryDate*[09/01/2026📅]Jurisdiction*[POPIA]NotificationDeadline[12/01/2026](72hours)INCIDENTDETAILSCategory*[CyberAttack]CyberAttackLost/StolenDeviceUnauthorisedAccessMisdirectedCommunicationPhysicalTheftOtherDataTypesAffected:☑Names☑IDNumbers☑Contact☐Financial☐Health☐Children'sDataEstimatedRecords[250______]affectedDescription:[Ransomwareattackonfileserver.Researcherdatabase][potentiallyaccessed.Serverisolated,forensic][investigationunderway.]RISKASSESSMENTSeverity*○Low●Medium○High○CriticalLikelihoodofHarm○Low●Medium○HighNOTIFICATIONSRegulatorNotified?○Yes●No○NotRequiredSubjectsNotified?○Yes●No○NotRequired[Cancel][LogIncident]

Part 5: ROPA

What is ROPA?

ROPA=RecordofProcessingActivitiesDocumentsallprocessingofpersonalinformation:•Whatdatayoucollect•Whyyouprocessit(legalbasis)•Whohasaccess•Howlongyoukeepit•WhatsecuritymeasuresprotectitRequiredunderPOPIA,GDPR,andNDPA

Add Processing Activity

ADDPROCESSINGACTIVITYActivityName*[ResearcherRegistration_______]Department[ResearchServices_____________]Jurisdiction[POPIA]DATACATEGORIESPersonalDataTypes:☑Names☑ContactDetails☑IDNumbers☐Financial☐Health☐Biometric☑Photos☐Children'sDataLEGALBASISPurpose*[Registrationandaccesscontrol][forreadingroomservices.]LegalBasis*[Consent]ConsentContractLegalObligationVitalInterestsPublicInterestLegitimateInterestsRETENTION&SECURITYRetentionPeriod[5]yearsafterlastvisitSecurityMeasures:☑AccessControl☑Encryption☑Backup☑AuditTrailDATASHARINGRecipients[Staffonly-nothirdparties]Cross-borderTransfer○Yes●No[Cancel][SaveActivity]
CONSENTRECORDSubjectName*[MaryJohnson_________________]SubjectEmail[mary.johnson@example.com_____]ConsentPurpose*[Emailnewslettersubscription]ConsentGiven[15/01/2026📅]Method[WrittenForm]WrittenFormOnlineFormVerbal(recorded)EmailConsentTextShown:[Iagreetoreceivemonthlynewsletterupdatesabout][archiveeventsandnewcollections.IunderstandI][canunsubscribeatanytime.]EvidenceAttached:[📎ConsentFormSigned.pdf]Jurisdiction[POPIA][Cancel][SaveConsent]

Part 7: PAIA Requests (South Africa)

What is PAIA?

PAIA=PromotionofAccesstoInformationActGivesthepublictherighttoaccess:•Recordsheldbygovernmentbodies•Recordsheldbyprivatebodies(ifneededforrightsprotection)Responsedeadline:30days(canextendbyanother30ifnecessary)RelatedtobutseparatefromPOPIA

Part 8: PII Detection

What is PII?

PII=PersonallyIdentifiableInformationInformationthatcanidentifyanindividual:•Names•IDnumbers(SAID,passport,etc.)•Emailaddresses•Phonenumbers•Bankaccountnumbers•TaxnumbersThesystemautomaticallyscansyourrecordsforPIItohelpyoucomplywithprivacyregulations.

PII Types Detected

TYPERISKEXAMPLESAIDNumberHIGH8501015800083NigerianNINHIGH12345678901PassportNumberHIGHA12345678BankAccountHIGH1234567890CreditCardCRITICAL4111-1111-1111-1111TaxNumberHIGH0123456789EmailAddressMEDIUMjohn@example.comPhoneNumberMEDIUM27821234567PersonNameMEDIUMJohnSmith(viaAI)OrganisationLOWACMECorp(viaAI)PlaceLOWJohannesburg(viaAI)

How to Access PII Scanner

MainMenuAdminPrivacyCompliancePIIScanner(scananddetectPII)Dashboard(statisticsoverview)RunScan(batchscanrecords)Review(approve/rejectfindings)...otheroptions...

Or from any record:

ViewanyarchivaldescriptionSidebar(rightside)"Privacy&PII"sectionScanforPII(scanthisrecord)PIIReviewQueue(seeallpending)PIIDashboard(statistics)

Scan Individual Record

PIIDETECTIONRESULTS⚠️3high-riskPIIentitiesdetected!🔴SAIDNumbers(1)8501****083🟡EmailAddresses(1)jo***@example.com🔵People(viaAI)(2)JohnSmithMaryJonesRiskScore:45/100[ReviewPII]

PII Scanner Dashboard

PIIDETECTIONSCANNEROBJECTSSCANNEDWITHPIIHIGH-RISK1,24515623recordsrecordsrecords🔴RUNPIISCANRepository[Allrepositories]BatchSize[50objects]25objects50objects100objects250objects[StartScan]HIGH-RISKOBJECTS🔴ObjectPIICountScannedActionsPersonnelFile1954122026-01-20[View]MedicalRecordsBox82026-01-20[View]ApplicationForms62026-01-19[View]

Review PII Entities

PIIREVIEWQUEUEPending:47StatusTypeValueObjectActions🔴FlagSA_ID8501****083File#123[✓][✎][✗]🟡PendEMAILjo***@mail.comLetter#45[✓][✎][✗]🟡PendPERSONJohnSmithReport#67[✓][✎][✗]🟣ISADPLACEJohannesburgReport#67[✓][✎][✗]REVIEWACTIONS✓APPROVE-NotsensitivePII,canremainvisible✎REDACT-IsPII,shouldbemasked/restricted(ForPDFs:blackboxesappliedtotext)✗REJECT-Falsepositive,notactuallyPII

Entity Sources (Badge Colors)

PIIENTITYSOURCES🔵NER(Blue)-AI-extractedfromtext/imagesviaNERTypes:PERSON,ORG,GPE,DATE🔴Regex(Red)-Pattern-matchedPIIidentifiersTypes:SA_ID,EMAIL,PHONE,BANK_ACCT🟣ISAD(Purple)-FromISAD(G)accesspointsTypes:Subject,Place,Name,DateNote:ISADaccesspointsaremetadatafieldsyouentered.Theymaycontainnames,places,ordatesthatneedtoberedactedfrompublic-facingdocuments.

Using the Command Line

CLICOMMANDSFORPIISCANNING#Reportmatcheswithoutwriting(dryrun)phpartisanahg:privacy-scan-piidry-run#Scanrecordsupdatedsinceadatephpartisanahg:privacy-scan-piisince=2026-01-01#Batchscan50recordsphpartisanahg:privacy-scan-piilimit=50#Scanfromaspecificsourceconnectionphpartisanahg:privacy-scan-piiconnection=atom#Showdetailedoutputphpartisanahg:privacy-scan-piiverbose

Risk Score Explained

RISKSCORECALCULATIONScoreRangeClassificationActionRequired0-20🟢LowRiskMonitor21-50🟡MediumRiskReviewrecommended51-100🔴HighRiskImmediatereviewHowthescoreiscalculated:•CriticalPII(creditcards)×30pointseach•High-riskPII(IDnumbers)×20pointseach•Medium-risk(email,phone)×5pointseach•Low-risk(names,places)×1pointeachMaximumscore:100

Part 8b: PDF Redaction

What is PDF Redaction?

PDFREDACTION=PermanentlyremovingsensitiveinformationfromPDFdocumentsWhenyoumarkaPIIentityforredaction:•ThesystemsearchesthePDFforthattext•Appliesblackboxesovermatchingtext•Createsanew"redacted"versionofthePDF•PublicusersseeonlytheredactedversionOriginalPDFsarePRESERVED-onlycopiesareredacted.

PDF Redaction Workflow

RecordhasPDFScanforPII(AdminPrivacyPIIScanner)Reviewdetectedentities✓Approve✎Redact✗RejectNotPII,MarkforFalsepositive,keepvisibleredactionremovefromlistSystemgeneratesredactedPDF(blackboxesoversensitivetext)PublicusersseeredactedversionStaffseeoriginal(ifpermissions)

What Gets Redacted

SOURCESOFREDACTIONTERMS1.NER-ExtractedEntitiesNames,organizations,placesextractedfromOCRtext2.Regex-DetectedPIIIDnumbers,emails,phonenumbersfoundinmetadata3.ISADAccessPoints•Subjects:Topictermslinkedtotherecord•Places:Geographiclocations•Names:People/organizationsfromevents•Dates:DaterangesfromeventsOnlyentitiesmarkedwithstatus"Redact"areapplied.

View Redacted PDF

HOWPUBLICUSERSSEEREDACTEDPDFsWhenviewingarecordwithredactedPII:1.ThePDFviewershows"PIIRedacted"badge2.Sensitivetextappearsasblackboxes:████████3.Theunderlyingtextispermanentlyremoved4.Copy/pastewon'trevealoriginaltext📄DocumentViewer[PIIRedacted]EmployeeName:█████████████████IDNumber:██████████████Department:HumanResourcesDate:15March1985Note:Originalfileremainsavailabletostaffwithappropriatepermissions.

Tips for Effective Redaction

✓DO✗DON'TReviewallentitiescarefullyBlindlyredacteverythingCheckISADaccesspointsIgnorepurplebadgesVerifyPDFhastextlayerAssumescannedPDFsworkTestredactedoutputSkipverificationDocumentyourdecisionsLeaveaudittrailgapsRe-scanaftermetadataeditsAssumeonescanisenough

PDF Requirements for Redaction

PDFREQUIREMENTSForredactiontowork,PDFsmusthave:✓Textlayer(notjustscannedimages)✓Searchabletext(canbeOCR'dornative)IfyourPDFisascanwithoutOCR:1.Thesystemcannotlocatetexttoredact2.ConsiderrunningOCRfirst(e.g.,usingTesseract)3.Re-uploadtheOCR'dversionHowtocheckifPDFhastext:•OpenPDFinviewer•Trytoselect/highlighttext•Ifyoucanselectit,redactionwillwork

Part 9: Compliance Dashboard

Overview Screen

PRIVACYCOMPLIANCEDASHBOARDDSARREQUESTSDATABREACHESCOMPLIANCESCOREOpen:8ThisYear:2Overdue:1🔴Open:087%AvgResponse:LastIncident:🟢Good18days45daysagoUPCOMINGDEADLINES⚠️DSR-003-BobWilsonAccessRequest-OVERDUE8days🟡DSR-001-JohnDoeAccessRequest-Duein5days🟡ROPAAnnualReview-Duein14days🟢IORegistrationRenewal-Duein60daysCOMPLIANCECHECKLIST☑InformationOfficerregistered☑ROPAdocumented☑Privacynoticepublished☐AnnualPOPIAtrainingcompleted☐Operatoragreementsreviewed

Quick Reference

TASKHOWTODOITViewdashboardAdminPrivacyDashboardConfigurejurisdictionAdminPrivacyConfigLognewDSARAdminPrivacyDSARAddReportbreachAdminPrivacyBreachesAddprocessingactivityAdminPrivacyROPAAddRecordconsentAdminPrivacyConsentManageofficersAdminPrivacyOfficersGeneratereportAdminPrivacyReportsScanforPIIAdminPrivacyPIIScannerScansinglerecordRecordpageScanforPIIReviewPIIfindingsAdminPrivacyPIIReview

Key Deadlines

RESPONSEDEADLINES📨DSARREQUESTSPOPIA/GDPR/NDPA/Kenya:30calendardaysCCPA:45calendardaysPIPEDA:30calendardays🚨BREACHNOTIFICATIONPOPIA:AssoonasreasonablypossibleGDPR:72hourstoregulatorNDPA:72hoursCCPA:Mostexpedienttimepossible📋PAIAREQUESTS(SAonly)Initialresponse:30daysExtensionpossible:30days

Tips for Best Practice

✓DO✗DON'TLogallrequestsimmediatelyIgnorerequestsVerifyidentitycarefullyReleasewithoutverifyDocumentalldecisionsSkiptheaudittrailTrainstaffregularlyAssumeeveryoneknowsReportbreachespromptlyCoverupincidentsReviewROPAannuallyLetitgetoutdatedKeepconsentevidenceAssumeconsentRespondwithindeadlinesMissdeadlines

Regulators Contact

JURISDICTIONREGULATORWEBSITE🇿🇦POPIAInformationRegulatorjustice.gov.za🇳🇬NDPANDPCndpc.gov.ng🇰🇪KenyaDPAODPCodpc.go.ke🇪🇺GDPRNationalDPA(variesbycountry🇨🇦PIPEDAOPCpriv.gc.ca🇺🇸CCPACPPAcppa.ca.gov

Troubleshooting

ProblemSolutionCan'tfindPrivacymenuCheckAdminpermissionsMayneedadminroleJurisdictionnotshowingEnableinConfigurationCheckit'sactivatedDeadlinecalculatingwrongCheckjurisdictionsettingsVerifyresponsedayssetCan'tattachdocumentsCheckfilesize(<10MB)UsePDF/JPG/PNGformatReportwon'tgenerateSelectdaterangeEnsuredataexists

Need Help?

Contact your system administrator or Information Officer if you experience issues.

For regulatory guidance:

Part of the Heratio AHG Framework