The information regulator published a notice on the Code of Conduct for the Credit Bureau Association (CBA) in terms of section 62(1) of the Protection of Personal Information Act (POPIA). The code deals with how personal information will be processed in the credit sector in South Africa. In this post, we highlight some of the changes in the revised code since the period for comments on the draft version closed on 29 January 2022.

When does the code come into effect?

Under section 62(2) of POPIA, the code will come into force and be binding on every member of the CBA 28 days after the regulator publishes it in the gazette. The regulator published the notice in the gazette on 7 October 2022.

The code will come into effect on 4 November 2022

The CBA will also publish the commencement and termination date of the code of conduct on its website.

Purpose

The purpose of the code is to govern the conditions for the lawful processing of personal information by members of the CBA by:

  • promoting appropriate practices by CBA members when they process personal information;
  • encouraging CBA members to establish appropriate agreements with third parties regulating the processing of personal information; and
  • establishing procedures for CBA members to guide their interpretations of POPIA provisions and other laws. The procedures will allow people to lodge complaints against credit bureaus.

Governance matters

According to the notice issued on 14 January 2022, the CBA resubmitted its unchanged code of conduct for consideration following the rejection of the previous application ‘due to representativity threshold not being met.’ On 30 May 2022, the regulator issued another notice and allowed affected persons to submit comments 14 days after publication of the notice in the Gazette. These provisions have remained the same as in the draft version. The CBA will enforce the provisions of the code of conduct. Additionally, registered credit bureaus that are members of the CBA who process personal information belonging to data subjects.

What else does the code cover?

These are the provisions we think you need to know about:

  • Since the first notice in April 2021, the code has been condensed from over 70 pages long to 27 pages.
  • The CBA has drafted a Credit Bureau Compliance Monitoring Plan which it will use in the monitoring of its members’ adherence to this Code of Conduct.
  • The code of conduct applies to the processing of personal information (including consumer credit information) belonging to data subjects (natural and juristic) by registered credit bureaus that are members of the CBA.
  • All terms used in the code share the same definition as in the National Credit Act (NCA), POPIA, and its regulations.
  • The regulator likely carried over its learnings from the banking industry’s code of conduct when it comes to the conditions for lawful processing because they are similar.

Code of Conduct: Lawful Processing of Personal Information by credit bureaus in South Africa

This is the full name of the code that the regulator published.

Actions you can take

  • Read the full version of the code of conduct by downloading it.
  • Keep updated with further developments from the information regulator by following our Insights page.