The Protection of Personal Information Act (POPI) was passed in South Africa in 2013. The purpose of the POPI Act is to safeguard individuals from data security breaches, theft, and discrimination. In this article we will cover what POPI means for South African institutions and data processors. Continue reading to find out what the POPI Act entails and how to comply with the law.
What is the POPI Act in South Africa?
POPI stands for the Protection of Personal Information Act No. 4 of 2013. It is similar to the European Union’s General Data Protection Regulation (GDPR), so you can consider our POPI Act as the South African version of European regulation.
In a nutshell, POPI applies rules for the correct handling of personal data of South Africans. It is comprised of eight general conditions as well as three less descript conditions. Just like the GDPR, the POPI Act in South Africa makes entities accountable for breaches of personal data. It also gives South Africans rights in terms of unsolicited electronic communications.
Who Does POPI Apply to?
A data processor is someone who uses automated or non-automated means to process personal information in the Republic of South Africa. The term “responsible party” refers to an entity that collects personal information for a data processor.
“Automated” refers to the use of technology that processes data automatically based on a data processor’s instructions.
POPI controls your business’s use of a citizen’s personal information. Personal information is considered: “information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person.”
Who is Exempt from POPI?
POPI primarily applies to people or groups in South Africa who process data for commercial purposes.
The law lists several exclusions that will exempt you from having a claim, such as:
- Data that is processed for personal reasons
- Data that was de-identified and can’t be reinstated
- Data processed by or for a public body associated with the justice system, law enforcement, or national security.
- Data processed by the province’s Cabinet, committees or Executive Council.
The data also includes any processing done for literary or artistic expression or for the purpose of journalism. The POPI has deemed processing for these purposes to be a matter of public interest and any limits on the processing is considered an infringement on free expression.
We hope that this has given you a better understanding of what the POPI Act is in South Africa.
