There is less than a month to go before South Africa’s Protection of Personal Information Act, 2013 (“POPIA”) is set to go into full effect on 1 July, 2021.
It is critical for organisations operating in South Africa to ensure that they are ready if and when the Information Regulator comes knocking.
It is only when organisations start their POPIA journey that they realise just how wide the POPIA net is cast, and that very few businesses fall outside of its reach. The road to POPIA compliance should be viewed as a marathon, and not a sprint. While implementing and maintaining an effective POPIA compliance program will take continued effort and resources well beyond the July 1, 2021 go-live date, here we outline five steps to which companies subject to POPIA should give their attention in the short term.
Step 1: Identify and appoint an Information Officer
POPIA provides for a similar position as the GDPR’s data protection officer in the form of an “Information Officer.” Organisations subject to POPIA must identify an Information Officer who will be responsible (and who may be held personally liable) for, among other things, all of the organisation’s data protection compliance requirements, working with the Information Regulator, establishing policies and procedures, and POPIA awareness and compliance training.
The “head” of the organisation (i.e., the CEO, managing director, or “equivalent officer”) is automatically deemed the organisation’s Information Officer, however, the organisation can “duly authorise” another person in the business (who is at management level or above) to act as Information Officer. Similarly, the organisation can designate one or more employees (also at management level or above) to act as “Deputy Information Officers” to assist the Information Officer perform his or her responsibilities. Both the Information Officers and Deputy Information Officers must be registered with the Information Regulator before the end of June 2021, via the Information Regulator’s Online Registration Portal, or by submitting the downloadable Manual Registration Form to the Information Regulator.
Step 2: review the organisation’s marketing practices
While many organisations may not consider themselves to be engaging in so-called “direct marketing” practices, this concept is widely defined in POPIA to include “any approach” to a data subject “for the direct or indirect purpose of […] promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject […].” POPIA provides data subjects with certain rights with respect to unsolicited “electronic communications” (i.e., direct marketing by means of automatic calling machines, fax machines, SMSs, or emails). The processing of a data subject’s personal information for the purposes of direct marketing is prohibited, unless the data subject has consented to the processing, or the email recipient is an existing customer of the organisation.
In practical terms, the organisation must have obtained the data subject’s details through the sale of a product or service, and the marketing should only relate to similar products or services of the organisation. The data subject must be given a reasonable opportunity to object to the use of their personal information for marketing each time the organisation communicates with the data subject for marketing purposes, i.e., recipients must be able to “opt-out” at any stage. Potential new customers can only be marketed with their express consent, i.e., on an “opt-in” basis.
Step 3: Review the organisation’s security measures
POPIA obliges organisations to take appropriate technical and organisational measures to safeguard the security and confidentiality of personal information – aimed at preventing any loss, damage to, or unauthorised destruction of personal information, including measures to prevent unlawful access to, or processing of personal information under the organisation’s control.
There is a general data breach notification obligation under POPIA. Where there are reasonable grounds to believe that a data subject’s personal information has been accessed or acquired by an unauthorised person, the organisation, or any third party processing personal information under its authority (e.g., an outsourced payroll service provider), must notify the Information Regulator and the data subject of the data breach “as soon as reasonably possible,” unless the identity of the data subject cannot be established. It is therefore crucial that organisations ensure that they have an effective data security incident protocol in place, which will allow them to comply with the breach notification obligations under POPIA, and avoid falling under additional scrutiny.
Step 4: Review the organisation’s existing data transfer and outsourcing arrangements
POPIA generally applies not only to organisations that process personal information in South Africa, but also to any person or company that processes personal information on behalf of the organisation – commonly referred to as a “processor.” POPIA also applies to organisations outside of South Africa that process personal information in South Africa with the assistance of a third party (e.g., a channel partner, or outsourced service provider). Where any processing of personal information is outsourced by an organisation, it must, in terms of a written contract between it and the processor, ensure that the party processing personal information on the organisation’s behalf establishes and maintains appropriate security measures as prescribed under POPIA.
POPIA contains a general prohibition on cross-border transfers of personal information. However, this prohibition is subject to numerous exceptions, including: (1) where the data subject consented to the transfer; (2) the transfer is necessary for the performance of a contract between the company and the data subject; (3) the transfer is necessary for the conclusion or performance of a contract between the company and a third party that is in the interest of the data subject; or (4) the transfer is for the benefit of the data subject. Where personal information is being transferred to a third party outside of South Africa, the company must ensure that the recipient of the personal information is subject to a law, binding corporate rules, or binding contract which provide an adequate level of protection that effectively upholds POPIA’s principles for reasonable processing, and that include provisions substantially similar to the conditions for the lawful processing of personal information, and for the further transfer of personal information under POPIA.
Step 5: Deliver POPIA awareness training
POPIA awareness training is a not only a valuable tool for organisations to promote compliance, it is also a requirement under the POPIA Regulations. The Information Officer must ensure that awareness sessions are conducted regarding the provisions of POPIA, the POPIA Regulations, codes of conduct (where applicable), as well as any information that is obtained from the Information Regulator from time to time.