PROTECTION OF PERSONAL INFORMATION ACT (Also known as POPIA)

Why do we need the Protection of Personal Information Act

The Protection of Personal Information Act (POPIA) is South Africa’s data protection law.  Essentially, the purpose of the Act, is to protect people from harm, by protecting their personal information. To stop their money being stolen, to stop their identity being stolen, and generally to protect their privacy, which is a fundamental human right.

The Protection of Personal Information Act, in the most simple terms, sets out ways in which businesses must deal with personal information that they hold. This includes personal details of their employees, as well as the personal details of their customers, clients and service providers, whether the customers and clients are individuals or other businesses/entities.

No matter the size of your business operation, you will have details of your customers, employees and third parties that provide services to you, either online or on paper. As such, you should now commence steps to make sure the information is secured as required by POPIA, (The POPI commencement date is 1 July 2020;   with the deadline for organisations to comply  by 1 July 2021. )

To achieve this, the Protection of Personal Information Act sets conditions for when it is lawful for someone to process someone else’s personal information.

Who are the Role Players?

The Protection of Personal Information Act (POPIA) involves three parties (who can be natural or juristic persons):

• The data subject: the person to whom the information relates.
• The responsible party: the person who determines why and how to process. For example, profit companies, non-profit companies, governments, state agencies and people. Called controllers in other jurisdictions
• The operator: a person who processes personal information on behalf of the responsible party. For example, an IT vendor. Called processors in other jurisdictions.

The Protection of Personal Information Act places various obligations on the responsible party, which is the body ultimately responsible for the lawful processing of personal information. Responsible parties should only use operators that can meet the requirements of lawful personal information processing prescribed by the Protection of Personal Information Act.

 

Who is affected

Any natural or juristic person who processes personal information, including large corporates and government. The data protection laws of many other countries exempt SMEs, but not currently in South Africa. Maybe the Information Regulator will exempt some natural persons and SMEs from complying. Only time will tell in this regard. Some processing of personal information is excluded.

What steps will you have to take to comply?

Responsible parties will have to take various steps to comply. For example:

1. Appoint an Information Officer.
2. Draft a Privacy Policy.
3. Raise awareness amongst all employees.
4. Amend contracts with operators.
5. Report data breaches to the regulator and data subjects.
6. Check that they can lawfully transfer personal information to other countries.
7. Only share personal information when they are lawfully able to.

What are the Penalties for Non-compliance?

There are essentially two legal penalties or consequences for the responsible party:

1. A fine or imprisonment of between R1 million and R10 million or one to ten years in jail.
2. Paying compensation to data subjects for the damage they have suffered.

It is very unlikely that anyone will go to jail and the fines are small compared to other jurisdictions. The other penalties include:

• Reputation damage
• Losing customers (and employees)
• Failing to attract new customers

But your main motivation for complying with the Protection of Personal Information Act (POPIA) should be to protect people from harm.