When Does GDPR Apply to Your South African Business?

Many South African businesses assume that the GDPR is a European problem. In fact, Article 3 of the GDPR extends its reach to organisations outside the European Union in defined circumstances. A business that falls within those circumstances must comply with the GDPR in addition to POPIA, and faces fines of up to EUR 20 million or 4% of worldwide annual turnover for the most serious breaches.

01You Have an Establishment in the EU

Under Article 3(1), the GDPR applies to processing in the context of the activities of an establishment in the EU, regardless of where the processing takes place. A branch, subsidiary or office in an EU member state will usually bring the related processing within the GDPR.

02You Offer Goods or Services to People in the EU

Article 3(2)(a) applies the GDPR to a business without an EU establishment that processes personal data of people who are in the EU in connection with offering them goods or services, whether or not payment is required. The test is whether the business intends to target people in the EU.

The European Data Protection Board's guidelines on territorial scope list factors that point to targeting, including:

• pricing or accepting payment in euro or another EU currency;
• delivering goods to, or providing services in, EU member states;
• using EU languages or country domains other than your own;
• advertising or search engine marketing aimed at EU audiences; and
• referring to EU customers or offering EU contact details.

A website that is merely accessible from Europe, or an email address that Europeans could use, is not enough on its own. Note also that the test concerns people located in the EU. Processing the information of an EU citizen who lives in South Africa does not, by itself, trigger the GDPR.

03You Monitor the Behaviour of People in the EU

Article 3(2)(b) applies the GDPR where a business monitors the behaviour of people in the EU, to the extent that the behaviour takes place in the EU. This includes tracking online activity through cookies or similar technologies for profiling, behavioural advertising, location tracking and analysis of preferences. Businesses using advertising technology on websites or apps with an EU audience should consider this trigger carefully.

04What the GDPR Then Requires

If the GDPR applies, the obligations are substantial. The most commonly overlooked are:

• An EU representative. Article 27 requires a business caught by Article 3(2) to appoint, in writing, a representative in a member state where the affected individuals are located, unless its processing is only occasional, does not involve large scale special category data and is unlikely to result in a risk to individuals. Failure to appoint a representative has itself resulted in fines.
• A lawful basis under Article 6 for each processing activity, and transparent privacy notices under Articles 13 and 14.
• Records of processing activities under Article 30.
• Breach notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk. POPIA requires notification as soon as reasonably possible, so the GDPR deadline is the stricter one to plan around.
• Data protection impact assessments for high risk processing.

05How GDPR and POPIA Fit Together

POPIA continues to apply to processing by a South African responsible party, so a business within the GDPR's reach must satisfy both laws. The regimes are closely aligned, but there are important differences. POPIA protects juristic persons as well as natural persons, while the GDPR protects only individuals. The breach timelines differ, as do the grounds for transfers abroad.

Data moving from the EU to South Africa also needs attention. The European Commission has not issued an adequacy decision for South Africa, so EU businesses sending personal data to South African service providers will usually rely on standard contractual clauses under Article 46. South African businesses serving EU clients should expect to sign them.

06Practical Next Steps

1. Map where your customers, users and website visitors are located.
2. Review your website, pricing, marketing and tracking technologies against the targeting and monitoring tests.
3. If the GDPR applies, appoint an EU representative and update your privacy notices and records of processing.
4. Build a single compliance programme that meets the stricter requirement of POPIA or the GDPR on each point.