The Protection of Personal Information Act’s enforcement date is looming

Is Your Business POPIA Compliant?

POPIA Compliance ARMS LabourThe right to privacy is protected by section 14 of the Constitution of the Republic of South Africa, 1996. This right includes “informational privacy” which is a person’s right to control access to and end the use of their private information.

 South Africa’s data privacy law, Protection of Personal Information Act (“POPIA”), took effect on 1 July, 2020, with an effective date for enforcement of 1 July, 2021. 

Employers have approximately four months to prepare and should take advantage of the grace period to stay ahead of requirements. In this article we discuss the purpose, scope of application, obligations in terms of POPIA and lastly, the benefits of becoming compliant with POPIA.

Purpose of the POPIA

According to Monty, the main purpose of POPIA is to safeguard personal information to protect the right to privacy and to regulate the manner in which personal information is processed. 

Does POPIA apply to employers?

POPIA applies to any company or organisation that processes POPIA’s definition of personal information in South Africa. Personal information refers to “any information relating to an identifiable living natural person or juristic person (companies or CC’s etcetera) and includes but is not limited to:

  1. contact details such as email, telephone and addresses;
  2. demographic information: age, sex, race, birth date, ethnicity;
  3. history: employment, financial, educational, criminal, medical;
  4. biometric information: blood type;
  5. opinions of and about the person;
  6. private correspondence;
  7. identifying information (identity number).

Those who process data on behalf of a responsible party, must also be aware of POPIA’s requirements, however it is ultimately the responsible party who must ensure lawful processing of personal information even when processed by an operator.

Obligations of employers

From the previous paragraph it is clear that employers, who process the above information regularly, are obligated to comply with the provisions of POPIA. Some of the obligations under POPIA, include:

  1. only to collect information that is needed for a specific purpose;
  2. apply reasonable security measures to protect the information;
  3. ensure information is relevant and up-to-date;
  4. only hold as much information as is needed, and only for as long as it is needed;
  5. allow the subject of the information to see it upon request;
  6. obtain prior consent from consumers to process their information;
  7. appoint an information officer to begin implementation.

A failure to comply with these obligations could have serious consequences as discussed below.

How can compliance with POPIA benefit your business?

According to de Stadler and Esselaar it is not only employees and consumers who should be aware of the benefits of POPIA, but more especially, businesses. Employers who want to protect their businesses can, therefore, justify committing resources to becoming POPIA compliant by considering the below factors:

Compliance may lead to increased business

Personal information is an asset in most industries. Regardless of whether the personal information is only used for marketing purposes, it is invaluable. Experts contend that becoming compliant will increase a business’ transparency which will inspire trust and goodwill. 

Customers are often drawn to businesses which they can  trust to lawfully processes and secure their personal information. As a result, POPIA compliance may make your business more marketable and consequently lead to more business.

Protection of reputation

ARMS POPIA ACTPrivacy has become increasingly important as a result of the digital era which we are relying on more than ever following the pandemic. Privacy breaches on digital platforms may result in losses of profit, but even more so could affect serious damage to the company’s reputation. Consumers who become aware of these breaches may no longer trust the businesses with their personal information and this may result in further losses.

Legal compliance

By investing in compliance with POPIA, businesses will be able to reduce the risks of fines and lawsuits which may follow non-compliance with POPIA. Serious contraventions of POPIA could lead to astronomical fines of R10 million or imprisonment of up to ten years.

Compliance increases savings

Experience has shown that investigations into the lawfulness of processing often exposes inefficient current data processing systems within the business. By investing in a legally compliant data processing system, employers often discover that this is a golden opportunity to inspect and revise the business’ current data processing system with the aim of saving time and resources in the future by following more efficient processing methods.

Lawful processing is a prerequisite for entry into information economy

An information economy refers to an economy based on the effective acquisition, dissemination, and use of information, rather than on the means of production. As stressed before, the post-pandemic era many employers are relying on the use of information to grow.

Businesses who are not compliant, will be unable to transact with those who are within the information economy. These businesses would therefore effectively be limiting their own opportunities, which could be detrimental in an era where every opportunity to transact is vital.

In Conclusion

If you are interested in learning more about how you can become compliant with POPIA before the deadline on 1 July 2021, or have any questions about the topics described in this article, please do not hesitate to contact our offices and speak to an Employment Law Specialist. 

The Association that cares, protects, and guides employers is ready and able to assist you.