FAQ

FREQUENTLY ASKED QUESTIONS?

What do you foresee as the biggest hurdle to POPI compliance for businesses?

Businesses will need to ensure that they implement and maintain appropriate, reasonable, technical and organisational security measures to safeguard personal information and prevent unlawful access to and unauthorised destruction of personal information. In the event that there are reasonable grounds to believe that there has been a data breach, the data subjects and the Information Regulator must be informed of the suspected breach. Businesses will also need to ensure that those employees who have access to personal information are subject to appropriate confidentiality undertakings. For some businesses, this may take some getting used to.

What measures will people be able to take if they feel that their data is being exploited/used without their permission?

Anyone may submit a written complaint to the Information Regulator in the prescribed manner and prescribed form. Upon receiving a complaint the Information Regulator may conduct a pre-investigation or a full investigation into the complaint or refer it to the Enforcement Committee. The Information Regulator may also decide to take no action or to act as a conciliator and secure a settlement between the parties. After completing the investigation, the Information Regulator may refer the matter to the Enforcement Committee for a finding or a recommendation on proposed action. The Information Regulator would then consider the recommendation and may serve an enforcement notice on the responsible party. The data subject may also institute a civil claim for damages or request the Information Regulator to institute a civil claim for damages.

Data subjects have rights of access in terms of PoPI. Before approaching the Information Regulator, the data subject may wish to approach the responsible party and request confirmation that it holds personal information about him/her/it and request a copy of it. They may also object to the processing of the personal information on reasonable grounds in the prescribed form.

What will be the penalty be for companies that are not POPI compliant?

Companies will generally first be issued with an enforcement notice. If the enforcement notice is not complied with then the penalty that may be imposed is a fine or imprisonment not exceeding ten years or both a fine and imprisonment. There are certain other offences which would attract such a penalty such as obstructing the Information Regulator or unlawful acts relating to an account number (i.e. unique identifier assigned by financial or other institution to access funds or credit facilities). A fine or imprisonment for up to twelve months or both a fine and imprisonment may be imposed for lesser offences. The maximum fine that may be imposed is R10-million.

Will companies be entitled to transfer personal information to locations outside South Africa?

A company may transfer personal information to recipients in locations outside South Africa if the recipient country has data protection laws similar to POPI. If there are not adequate protection laws, personal information may only be transferred to such countries if the data subject consents or if the recipient is subject to binding corporate rules or a binding agreement which provides an adequate level of protection effectively upholding the principles in POPIA, including the provisions relating to the further transfer of personal information.

It may also be transferred if the transfer is necessary for performance or conclusion of a contract in the interest of a data subject or where the transfer is for the benefit of the data subject and the data subject would likely give consent but it is not reasonably feasible to obtain consent.

Where special personal information (such as information pertaining to race, trade union membership, health, criminal behaviour, religious beliefs or political persuasion) or the personal information of children is transferred to a recipient in a country that does not have adequate data protection laws, then prior authorisation from the Information Regulator will be required.