POPIA Compliance Attorneys

01Who POPIA Applies To

The Protection of Personal Information Act 4 of 2013 (POPIA) applies to every public and private body that processes personal information in South Africa. There is no exemption for small businesses. If you keep client records, employee files, supplier details, CCTV footage or a marketing list, you are a responsible party under POPIA.

POPIA also protects juristic persons, so information about the companies you deal with is covered as well as information about individuals.

02What the Law Requires

POPIA sets eight conditions for the lawful processing of personal information, from accountability and purpose specification to security safeguards and data subject participation. In practice, most businesses need to address the following:

• Information Officer registration. Every responsible party must register its Information Officer, and any deputies, with the Information Regulator.
• A PAIA manual. The Promotion of Access to Information Act requires most private bodies to compile and publish a manual describing the records they hold and how to request them.
• Security safeguards. Section 19 requires appropriate and reasonable technical and organisational measures to protect personal information.
• Operator agreements. Section 21 requires a written contract with every operator, such as a payroll provider, IT service provider or cloud host, that processes personal information on your behalf.
• Breach notification. Section 22 requires notice to the Information Regulator and affected data subjects as soon as reasonably possible after a security compromise.
• Direct marketing rules. Section 69 restricts unsolicited electronic marketing to consenting recipients and existing customers.
• Cross-border transfers. Section 72 limits transfers of personal information outside South Africa.

03How We Help

• POPIA gap assessments that map what personal information you hold, where it goes and where you fall short.
• Remediation programmes covering privacy notices, internal policies, consent wording, retention schedules and staff guidance.
• Information Officer support, including registration, training and an outsourced Information Officer service on retainer.
• PAIA manuals drafted for your business and kept up to date.
• Operator agreements and data processing terms for your service providers.
• Privacy impact assessments for new products, systems and acquisitions.
• Data breach response, including notification to the Regulator and data subjects and managing liability.
• GDPR alignment for businesses that also serve clients in the European Union. Read when the GDPR applies to South African businesses.

04Our Process

1. Consultation. We discuss your business, the information you process and any immediate concerns.
2. Assessment. We review your current practices and documents against POPIA and give you a prioritised findings report.
3. Remediation. We prepare the documents and processes you need and work with your team to implement them.
4. Ongoing support. We remain available for breaches, Regulator correspondence, new projects and annual reviews.

05The Cost of Getting It Wrong

The Information Regulator can issue enforcement notices and impose administrative fines of up to R10 million. Certain offences under POPIA carry criminal penalties, including imprisonment. Data subjects may also claim damages in civil proceedings. The Regulator has made clear that unregistered Information Officers, weak security and unlawful direct marketing are enforcement priorities. Read the five POPIA mistakes we see most often.