Yes, public bodies must. Some people think that they don’t and it is not that clear when you read POPIA. But it is clear – all public bodies must comply. The Information Regulator has confirmed this.
POPIA “applies to the processing of personal information entered in a record by or for a responsible party” (Section 3). A responsible party includes “a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information”. A ‘‘public body’’ means:
- any department of state or administration in the national or provincial sphere of government or any municipality in the local sphere of government; or
- any other functionary or institution when:
- exercising a power or performing a duty in terms of the Constitution or a provincial constitution; or
- exercising a public power or performing a public function in terms of any legislation.
So a public body includes government departments, municipalities, and any institution performing a public power.
So, the answer is yes. All public bodies must comply with POPIA.