The Protection of Personal Information Act (“POPIA”) represents a significant shift in data protection and privacy in South Africa. Effective from July 1, 2021, POPIA places new obligations on how companies collect, process and store personal information. This article aims to demystify POPIA and explore what it means for companies operating in South Africa.

Understanding POPIA

POPIA is South Africa’s equivalent of the GDPR in the European Union. It’s designed to protect personal information processed by public and private bodies and introduces comprehensive privacy standards. The Act is built around principles of transparency, accountability and the individual’s right to privacy.

Key Obligations Under POPIA for Companies

1. Lawful Processing of Personal Information: Companies must process personal information lawfully and in a manner that does not infringe on the privacy of the individual.

2. Consent Requirement: Consent is a cornerstone of POPIA. Companies need explicit consent from individuals to collect and process their personal information.

3. Purpose Specification: Information should be collected for a specific, explicitly defined, and lawful purpose related to the business's function.

4. Information Quality: Companies are required to take reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading, and updated when necessary.

5. Openness and Accountability: Companies must maintain documentation of all processing operations and be transparent about their data processing activities.

6. Security Safeguards: POPIA mandates companies to implement adequate security measures to prevent data breaches, loss, or damage of personal information.

Implications for Companies

• Compliance Measures: Companies must review and align their data protection policies and practices with POPIA requirements.

• Staff Training: Employees should be trained on the importance of data protection and the company's procedures for handling personal information.

• Data Protection Officer: Companies are encouraged to appoint a dedicated Information Officer to oversee compliance with the Act.

• Penalties for Non-Compliance: Non-compliance can lead to significant penalties, including fines of up to R10 million and even imprisonment.

Conclusion

POPIA is a critical development in South Africa’s data protection landscape, bringing the country in line with global data privacy standards. For companies, it means a greater responsibility in handling personal information, necessitating robust data protection policies and practices. Adherence to POPIA is not only a legal requirement but also an opportunity to build trust with customers and enhance the company's reputation for data privacy and security. If your company requires assistance with POPIA compliance or understanding its implications, Barter McKellar’s specialist commercial attorneys can help. We offer expert legal advice and support to ensure your business meets POPIA standards. Contact us for a consultation.