As technology keeps improving, our world today is undeniably digital and most businesses globally are taking full advantage of the benefits of our technological advancements. We now share our personal information online more often i.e., online banking, online shopping and especially on social media platforms, like Facebook, Twitter, YouTube, WhatsApp and LinkedIn. This puts us at risk of theft, identity theft, discrimination or harassment.
The Act shall come into effect from 1 July 2021, after which the grace period of one (1) year would have lapsed and business shall be required to comply. Therefore, accountability when dealing with personal information rests with the “responsible party” meaning a public or private or any other person which alone, or in conjunction with others, determines the purpose of and means for processing personal information.
Most businesses in South Africa will be impacted by the POPI Act in one or more ways. “Personal Information” broadly means any information relating to an identifiable, living natural person or juristic person (companies, CC’s etc.). This includes, but is not limited to:
• contact details: email, telephone, address etc.
• demographic information: age, sex, race, birth date, ethnicity etc.
• history: employment, financial, educational, criminal, medical history
• biometric information: blood type etc.
• opinions of and about the person
• private correspondence etc.
Some of the obligations under POPI Act in terms of processing such personal information are:
• to only collect information that you need for a specific purpose
• apply reasonable security measures to protect it
• ensure it is relevant and up to date
• only hold as much as you need, and only for as long as you need it
• allow the subject of the information to see it upon request
The Act applies to any person or organisation who keeps any type of records relating to the personal information of anyone. Section 107 of the Act details which penalties apply for non-compliance. For serious offences the maximum penalties are a R10 million fine or imprisonment for a period not exceeding 10 years or to both.
It is therefore vital for private and public bodies to comply with the provisions of the Act.
iR Worx have developed the relevant POPI / PAIA Policy manuals; Non-disclosure agreements and Data breach response policies. Therefore, should you require assistance to become compliant please visit our website for more details. We also in this article include a free of charge POPI compliance checklist for all our readers to use in ensuring that your business becomes compliant. Simply click on the link below to take up this offer.