What is Protection Of Personal Information Act (POPIA) & How Do I Comply?

Overview

South Africa’s Protection of Personal Information Act (POPIA) comes into effect on 1st July 2021. POPIA applies to public and private bodies that are domiciled in South Africa and process personal information or enter it into a record through either automated or non-automated means. The law also applies to bodies that are not domiciled in South Africa but use means to process personal information in South Africa unless such means are only used to forward the information through the country.

Definition of Personal Information

POPIA covers information relating to identifiable natural persons as well as existing legal persons and it provides the following non-exhaustive definition for what is ‘personal information’:

• Information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
• Information relating to the education or the medical, financial, criminal or employment history of the person;
• Any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;
• The biometric information of the person;
• The personal opinions, views or preferences of the person;
• Correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
• The views or opinions of another individual about the person; and
• The name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

Rights Under South Africa POPIA

POPIA grants the following rights to data subjects with respect to their personal information:

Responsibilities of Information Officer

Under the POPIA, organizations are required to appoint an information officer who will be responsible for encouraging compliance with the provisions of the POPIA. The information officer must ensure the following:

• A compliance framework is developed, implemented, monitored and maintained,
• A personal information impact assessment (PIIA) is done to ensure that adequate measures and standards exist in order to comply with the conditions for the lawful processing of personal data,
• A manual is developed, monitored, maintained and made available, as prescribed in the Promotion of Access to Information Act, 2000.
• Internal measures are developed together with adequate systems to process requests for information or access, and
• Internal awareness sessions are conducted regarding the provisions of POPIA, codes of conduct or information obtained from the regulator.