What is POPI Act?

The POPI Act is a South African data privacy law that regulates how personal information is collected, used, processed, stored, and shared by public and private entities. It aims to protect personal information and impose obligations on organisations that process it.

Introduction

The Protection of Personal Information Act (POPIA), also known as the POPI Act, is a South African data privacy law enacted on 1 July 2021.

As more organisations collect and process (and unfortunately abuse) our information, data privacy has become an increasingly important issue.

In this blog post, we will explore what the POPI Act is, who it applies to, and how it affects businesses. By the end of this post, you will have a better understanding of how the POPI Act affects you and your organisation.

Why are Data Privacy laws important?

Data privacy laws protect our personal information

Data privacy laws are important because they protect the personal data of individuals. This information can include a wide range of data, such as names, addresses, contact details, financial information, health information, religious or philosophical beliefs, political opinions, employment history, and personal or household activity.

By regulating how organisations collect, store, and use this information, data privacy laws help to prevent it from being misused or exploited.

Data privacy laws prevent our information from being stolen

Data breaches (e.g. hacking) can have serious consequences for individuals and organisations. Personal details stolen or leaked in a data breach can be used for identity theft, financial fraud, and other types of cybercrime.

Data privacy laws help to prevent data breaches by requiring organisations to implement appropriate security measures to protect our information from unauthorised access, theft, or loss.

Data privacy laws allow us to trust organisations with our information

When organisations are transparent about collecting and using personal information, they can build trust with their customers and stakeholders.

Data privacy laws can help to promote transparency by requiring organisations to disclose how they collect and use our personal data and by giving individuals the right to access and control their personal data.

Why was the POPI Act created?

The Protection of Personal Information Act was created to protect the privacy of personal information by regulating its collection, use, and disclosure by public and private entities, and by giving individuals the right to access and control their personal data.

As businesses collect ever larger amounts of data on individuals, for business functions such as electronic communication, direct marketing electronic communications, financial record storage, and more, such personal information must be protected.

What are the main provisions of the POPI Act?

1. Scope of the Act

1. Provides clear definitions of personal information 

2. Applies to both public and private entities

2. Conditions for lawful processing of personal information

1. Collection and processing of personal information with consent

2. Processing personal information for legitimate purposes

3. Processing of sensitive personal information with explicit consent

3. Rights of a person (data subject)

1. Right to access and correct personal information

2. Right to object to processing of personal information

3. Right to be forgotten

4. Right to data portability

4. Responsibilities of responsible parties

1. Implementation of appropriate security measures

2. Notification of data breaches to both the data subject and Infomation Regulator

3. Appointment of Information Officer

4. Compliance with the conditions for lawful processing of personal information

5. Enforcement and penalties

1. Enforcement of the Information Regulator of South Africa

2. Penalties for non-compliance with POPI Act

Overall, the Protection of Personal Information Act outlines the conditions for the lawful processing of personal information, the rights of data subjects, the responsibilities of responsible parties, and the enforcement and penalties for non-compliance.

Who does POPI Act apply to?

POPIA applies to both individuals and companies

Unlike GDPR, POPIA applies to both natural and juristic persons. Natural persons are you and me. Juristic persons are registered organisations. All organisations are considered data subjects and are afforded the same right of protection as individuals. 

Which organisations are affected by POPI Act?

POPI Act applies to both public and private organisations that process personal information. This includes any organisation that collects, stores, uses, or shares personal information about living individuals. Examples of organisations that are affected by POPI Act include government agencies, financial institutions, healthcare providers, marketing companies, and e-commerce businesses.

It is important to note that the Protection of Personal Information Act applies to organisations that are based in South Africa, as well as organisations that process personal information of South African residents from outside the country.

Therefore, any organisation that processes personal information of individuals in South Africa needs to comply with POPI Act.

What are the obligations of public and private organisations under the Act?

Organisations are obligated to act as a responsible party, uphold data privacy and protect the personal information of data subjects by:

1. Obtain Consent: organisations are required to obtain the consent of individuals before collecting, using, or disclosing their personal information. Consent must be freely given, specific, and informed, and individuals have the right to withdraw their consent at any time.

2. Implement Security Measures: organisations are responsible for implementing appropriate security measures to protect personal data from loss, theft, or unauthorized access. This includes physical, technical, and organisational measures to ensure the confidentiality, integrity, and availability of personal information.

3. Disclose Collection and Use of Personal Information: organisations must disclose to individuals the purposes for which personal information is collected and used. This includes informing individuals about who will have access to their personal information, how it will be used, and whether it will be shared with third parties.

4. Allow Access and Correction of Personal Information: Individuals have the right to access and correct their personal information held by organisations. organisations must provide individuals with access to their personal information upon request and must correct any inaccuracies in a timely manner.

5. Notification of Data Breaches: organisations are required to notify the Information Regulator and affected individuals in the event of a data breach that compromises personal information.

6. Appointment of Information Officer: organisations must appoint an Information Officer who is responsible for ensuring compliance with POPI Act. The Information Officer is responsible for managing data protection policies and procedures, and for responding to requests for access or correction of personal information.

What rights do individuals have under POPI Act?

Under the Protection of Personal Information Act, individuals have several rights to access and control their personal information held by organisations. These include:

1. Right of access: Individuals have the right to request access to their personal information held by an organisation. The organisation must provide the information in an understandable format and within a reasonable time frame.

2. Right to correction: Individuals have the right to request that their personal information be corrected if it is inaccurate, incomplete, or out of date.

3. Right to object: Individuals have the right to object to the processing of their personal information in certain circumstances, such as where the information is being processed for direct marketing purposes.

4. Right to be forgotten: Individuals have the right to request that their personal information be deleted or erased in certain circumstances, such as where the information is no longer necessary for the purpose for which it was collected.

5. Right to data portability: Individuals have the right to request that their personal information be provided to them in a structured, commonly used, and machine-readable format, and to transfer that information to another organisation if they wish.

How does an organisation comply with POPI Act?

As a responsible party under POPI Act, organisations are legally obligated to uphold data privacy and protect the personal information of data subjects.

They can comply with this by following these steps:

1. Conduct a data inventory: Businesses should conduct a thorough data inventory to identify what personal information they collect, where it is stored, how it is used, and who has access to it. This will help a responsible party to understand their data processing activities and identify any compliance gaps.

2. Develop and implement data protection policies and procedures: Businesses should develop and implement data protection policies and procedures that are tailored to their specific needs and risks. These policies and procedures should address issues such as data collection and processing, security measures, data retention, and incident response.

3. Appoint an Information Officer: Businesses should appoint an Information Officer who is responsible for ensuring compliance with POPI Act. The Information Officer should be knowledgeable about data protection and should have the authority to make decisions about data protection policies and procedures.

4. Train employees: Businesses should train their employees on data protection policies and procedures, including the importance of data protection, how to handle personal information, and what to do in the event of a data breach.

5. Implement appropriate security measures: Businesses should implement appropriate security measures to protect personal data from loss, theft, or unauthorized access. This may include physical, technical, and organisational measures, such as access controls, firewalls, encryption, and data backups.

6. Obtain consent: Businesses should obtain the consent of individuals before collecting, using, or disclosing their personal information. Consent should be freely given, specific, and informed, and individuals should be informed of their right to withdraw consent at any time.

7. Keep records: Businesses should keep records of their data processing activities, including the purposes of processing, the types of personal information processed, and the security measures implemented.

Final thoughts

Complying with POPI Act is important for businesses to protect the privacy of personal information, prevent data breaches, and build trust with customers.

Failure to comply with the Act's provisions can result in significant penalties and reputational damage.

As the rate of data creation and expansion accelerates, all businesses must ensure that they comply with POPI Act and protect the privacy and security of personal information.