Data is a key enabler of our Shared-value Insurance model. Without it, we would not be able to track and incentivise healthy behaviours, and measure if those behaviours are achieving real impact. But we are cognisant that our reputation is ultimately held in how we contract with our clients, which includes how we use data and how clients trust us with managing their data.
Discovery is unique in terms of the volumes of data we collect and analyse. We have a comprehensive Data Governance Policy Framework covering all aspects of the collection, use and retention of data. Over the year, we have focused on reinforcing the data governance foundation across the Group. This includes driving data quality initiatives, and instituting relevant governance forums, data stewards and working group initiatives to drive data management that align to data privacy requirements.
The Data Governance and Data Management Policy has been reviewed to include governance structures, data quality, data sharing and data classification. We established a Data Governance Forum, which is convened on a quarterly basis and chaired by the Group Chief Information Officer.
To protect client information, we have robust processes controlling access to specific systems and databases. Teams that perform analysis on data drawn from different businesses can only access consolidated and anonymised data stored in a central data lake, where access is strictly controlled.
With rapid advances in technology and big data, we are working to ensure that data management includes consideration of ethics and fair use in how our products are delivered. Supported by the Group Ethics Office, we aim to anticipate ethical issues and proactively build solutions into our products.
Also, with cyber security as an ongoing challenge, Discovery's data-centric model is critical to safeguard vital information while ensuring it is available to build, enhance and deliver products suited to the needs of our clients. Artificial intelligence and machine learning are playing a growing role in information security, as they are in other areas of the business. During the year, cyber-security training was rolled out across the South African operations.
The Group Ethics Office is providing an advisory role on megatrends that may impact the Group, including the ethical implications of artificial intelligence, machine learning and robotics. With the increasing pace of advancement in these fields, a more proactive approach to ethics is crucial in protecting the interests of our clients and remaining true to our values.
In South Africa, the Protection of Personal Information Act came into effect on 1 July 2020, as did the one-year transition period. The Act sets out a comprehensive set of conditions for governing the collection, processing, storage, communication and disclosure of personal information. Strict rules will be applied to the disclosure of personal information to any third party. Data breaches will require disclosure to impacted data subjects and the Information Regulator, and may result in financial penalties.
Discovery has undertaken a phased approach to the Protection of Personal Information Act, with impact assessments conducted by all product houses to determine the scope of the Act implementation and to prioritise high-risk areas. The first phase addressed high-risk areas (across secure communications, direct marketing consent, data anonymisation and governance), with the second stage addressing all remaining risks. Discovery's Protection of Personal Information Act programme will ensure that Discovery is fully compliant with the Act by 30 June 2021. The programme is driven from Group level and supported by the highest executive level in the Group.