Data protection Insights

Can we use software to implement POPIA?

The information regulator will not likely have any issue with you using software to implement POPIA if the software helps you protect personal information and avoid non-compliance. It is likely that the information regulator will encourage you to use data [...]

By Michalsons|2022-11-15T19:35:13+02:00August 7th, 2020|Categories: Information regulator, POPIA|

Must I notify the regulator if my employee loses a device with personal information on it?

It would depend on whether the personal information stored on the cellphone or laptop, for example, belongs to your data subjects or just the employee. If it belongs to your data subjects, and you as a responsible party believe that [...]

By Michalsons|2022-11-15T19:12:07+02:00August 7th, 2020|Categories: Breach|

What if another law requires me to retain a record that includes personal information?

If another law requires you to retain the information for a longer period than POPIA prescribes, that law will prevail.

By John Giles|2022-11-15T19:18:18+02:00August 6th, 2020|Categories: POPIA|

Is a personal information impact assessment (PIIA) different to a PIA?

No, they are essentially the same thing. PIA stands for a privacy impact assessment. In South Africa, they are referred to as a Personal Information Impact Assessment (PIIA), while in the EU, they are known as a Data Protection Impact Assessment [...]

By John Giles|2025-07-29T10:49:01+02:00August 6th, 2020|Categories: POPIA|

Will the regulator publish a list of countries that have adequate protection?

This seems unlikely for the foreseeable future. The regulator does not currently seem to have any plans to do this. Each responsible party will have to assess whether a country does have adequate protection and record their decision. This is [...]

By John Giles|2022-11-15T18:51:20+02:00August 6th, 2020|Categories: Information regulator, POPIA|

How do we enable data flows to South Africa?

This is a difficult one to answer. A related question is. What are we going to do in South Africa to ensure that data exporters in the EU/EEA are able to export data to data importers in South Africa?

By John Giles|2022-11-15T19:56:31+02:00August 6th, 2020|Categories: Information regulator, POPIA, Transborder data flows|

Will the regulator look at foreign laws and international best practice for the development of POPIA?

Yes, POPIA obliges them to do so and they have confirmed that they will. Where there is an extra compliance requirement in the GDPR, will the regulator develop POPIA to be more like the GDPR? Probably, mainly because South Africa [...]

By John Giles|2022-11-15T18:49:06+02:00August 6th, 2020|Categories: POPIA|

Will the POPIA grace period be extended?

No. The regulator has consistently said no. It will not be extended. Related questions are - Do you anticipate the regulator taking enforcement action soon after the deadline? Will the regulator expect responsible parties to comply right after the deadline? [...]

By John Giles|2024-02-06T14:09:29+02:00August 6th, 2020|Categories: Information regulator, POPIA|