The Protection of Personal Information Act (POPIA) is South Africa’s data protection law. This is a summary or short explanation of why it …
Generally speaking, no. The information regulator makes a distinction between guidance and advice. Guidance is where the regulator applies its knowledge, skill and expertise to a generic legal issue. Advice is where the regulator applies its knowledge, skill and [...]
Yes, public bodies must. Some people think that they don't and it is not that clear when you read POPIA. But it is clear - all public bodies must comply. The Information Regulator has confirmed this. POPIA "applies to the [...]
Have you been appointed as the information officer and are looking for a guide or handbook for information officers? What support is there for information officers? Guide for information officers Our data protection programme (and in particular our training for information [...]
As long you have some other justification that POPIA allows, you do not need the employee's consent. You can notify other employees if, for example, there's a law that requires you to or if you are doing it to protect [...]
The information regulator will not likely have any issue with you using software to implement POPIA if the software helps you protect personal information and avoid non-compliance. It is likely that the information regulator will encourage you to use data [...]
If another law requires you to retain the information for a longer period than POPIA prescribes, that law will prevail.
No, they are essentially the same thing. PIA stands for a privacy impact assessment. In South Africa, they are referred to as a Personal Information Impact Assessment (PIIA), while in the EU, they are known as a Data Protection Impact Assessment [...]
This seems unlikely for the foreseeable future. The regulator does not currently seem to have any plans to do this. Each responsible party will have to assess whether a country does have adequate protection and record their decision. This is [...]
This is a difficult one to answer. A related question is. What are we going to do in South Africa to ensure that data exporters in the EU/EEA are able to export data to data importers in South Africa?
Yes, POPIA obliges them to do so and they have confirmed that they will. Where there is an extra compliance requirement in the GDPR, will the regulator develop POPIA to be more like the GDPR? Probably, mainly because South Africa [...]
No. The regulator has consistently said no. It will not be extended. Related questions are - Do you anticipate the regulator taking enforcement action soon after the deadline? Will the regulator expect responsible parties to comply right after the deadline? [...]
