The information regulator invited comments on draft regulations that will amend the POPI regulations, 2018. The draft regulations mainly cover new proposed rules of procedure, administrative fines, and other proposed amendments to the POPI regulations, 2018. In this post, we summarise the draft regulations, enable you to download them, and list what actions to take in the meantime.

The deadline for submitting comments ended on 15 November 2021.

When will these POPIA Regulations commence?

The POPIA regulations will commence on a future date that the regulator will determine. We will update this post as soon as the regulator publishes the amended POPI regulations.

What do the draft POPIA regulations deal with?

  • A revised process on how a data subject can object to the processing of their personal information. This amendment will also amend form 1 (Objection to the processing of personal information). (Section 11(3) of POPIA).
  • How a data subject can request the correction or deletion of personal information, or the destruction or deletion of a record of personal information. This amendment will also amend form 2 (Request for correction or deletion of personal information or destroying or deletion of record of personal information). (Section 24(1) of POPIA).
  • Additional duties and responsibilities of Information Officer (IO). The amendments propose the deletion of sub-regulation 4(1)(c) which deals with the IO’s responsibility to develop, monitor, and maintain a PAIA manual.

    You should not interpret this amendment to mean that IO’s are not responsible for a PAIA manual. This proposed deletion categorises the requirement for a PAIA manual as a requirement under PAIA.  From 1 January 2022, everybody must have a PAIA manual, and your IO could face a fine or imprisonment of up to two years for non-compliance.

  • The application form for issuing a code of conduct (form 3) now refers to “relevant body/bodies” and not “private or public body”.
  • A revised process on how to request marketing consent. This amendment will also amend form 4 (Request for consent of a data subject for the processing for the purpose of direct marketing). (Section 69(2) of POPIA). (Important!)
  • New provisions relating to complaints such as who may lodge a complaint and a detailed process of how to submit complaints. There are also proposed changes to form 5 (Complaint regarding interference with the protection of personal information/complaint regarding determination of an adjudicator). (Section 74 of POPIA). (Important!)
  • Proposed deletion of forms 17 (Notice of appeal), 18 (Substitution or setting aside of enforcement notice) and 19 (Notice of dismissal of appeal).
  • A new provision for administrative fines. Responsible parties who are unable to pay fines in a lumpsum may make payment arrangements to do so. (Important!)

Actions you can take

  • You can delve into the detail by downloading a copy of the draft regulations.
  • Keep abreast of any updates to the POPIA Regulations, 2018 by visiting our main POPIA regulations page.