Frequently asked questions: Protection of Personal Information (POPI)

Compliance with the Protection of Personal Information Act (POPI Act or POPIA) is becoming increasingly crucial for businesses as Personal Information has become one of the most powerful commodities in the modern world.

Some business owners have not yet realised the importance of POPI Act compliance or still have many questions in this regard.

The POPI Act aims to encourage the free flow of Information in a secure and responsible manner in line with the Constitution.

In a previous blog, we discussed the exemptions and exclusions from the POPI Act , while in this blog we aim to answer a few frequently asked questions by business owners about POPI compliance.  

What is the difference between Confidential Information and Personal Information?

All Personal Information should be kept confidential, but not all confidential information is necessarily Personal Information. For example, trade secrets, business plans and operational methodology constitute Confidential Information but do not contain Personal Information.

What are typical examples of a POPI breach?

• Loss of Personal Information due to inadequate safeguards (dispensing sensitive information into the dustbin before shredding);
• Collecting Personal Information without consent, or using current information for purposes other than was originally consented to, for example marketing without consent;
• Sending an e-mail containing Personal Information to the wrong person;
• Losing a laptop;
• Database is hacked;
• Non-compliance with the enforcement notices issued by the Information Regulator;
• Processing Special Personal Information (such as religious beliefs, race or ethnic origin etc.) without following the correct procedures.

Which section of the POPI Act refers to an ‘independent legal advisor’?

Throughout the POPI Act, reference is made to a ‘Professional legal advisor’ – which means any legally qualified person, whether in private practice or otherwise, who lawfully provides a client at his or her or its request, with independent, confidential legal advice.

Why can you not use your own employees to conduct an audit after they completed a POPI Compliance seminar?

In order to provide substance and integrity to an audit, the audit should always be independent, objective and impartial.

Section 76(4)(5) of the Companies Act refers specifically to the directors’ diligent steps (also referred to in the POPI Act) and their duty to become informed and advised by professional advisors about a matter. If a director in good faith decides to act upon a opinion provided by such person, he or she will not be held liable. The main point is that directors should be rational and seek counsel from a professional who is competent to advise on such matters.

Example: Your own employees will therefore not be able to conduct an assessment because it does not fall within their profession. They lack the necessary professional acumen to express an independent opinion and exercise an independent judgement on such matters.

What qualification do you need to conduct a POPI Audit?

The Information Regulator presently does not have the authority to grant qualifications to juristic persons or individuals to conduct POPI audits. POPI audits in the private sector are therefore conducted by Professionals who have specialised, knowledge, experience, and prowess in the specific field.

Why do we need POPI Act awareness training?

The Regulations specifically state that all Information Officers should make sure that employees attend internal awareness programmes and training. In addition to our Information Compliance service offering, we also offer businesses Information Compliance training that includes training on POPI, PAIA and Consumer Law compliance requirements. For a quotation on our Information Compliance training, please contact us for more information.

Where do I lodge a complaint?

You can lodge a complaint on complaints.IR@justice.gov.za.

I run a small business with few staff members and clients. Why must I adhere to the POPI Act?

The Act does not distinguish between small, medium and large businesses. Everyone is measured according to the same standard. All businesses and entities such as schools and churches have Personal Information in their possession and process such information.

What is the benefit for me or my business when I comply with the POPI Act?

The benefit lies in the fact that you are operating lawfully in terms of South African legislation. It demonstrates on entities principals and ethnic values. Consumer confidence studies have shown that in 90% of cases, consumers prefer to do business with companies that are ethical, transparent and comply with legislation, rather than with any other business.

POPI Act non-compliance

Apart from facing civil claims, businesses that do not comply with the Act will be paying fines (administrative fines) of up to R10 million and can be blacklisted. Their officials could even face imprisonment for periods ranging from 12 months to 10 years. The Information Regulator will also stop your organisation from processing information to ensure that you are unable to do business. Reputational damage due to non-compliance is a material commercial risk. Directors may also be declared unfit to serve as a director in terms of the Companies Act.

SERR Synergy assists businesses by ensuring that Personal Information is processed according to legislation, while simultaneously serving the needs that a business may have with such data.

We provide a full range of Information Compliance service offerings, be it compiling Data and Information Protection Reports, drafting the required Data Privacy policies, updating your agreements to handle data considerations, advising on internal data-handling requirements or understanding the exact data privacy role you fulfil.

We recommend that businesses start the compliance process sooner rather than later. If you want your organisation to be POPI compliant and ready by 1 July 2021, feel free to contact us for more information.

About the Author: Retha van Zyl completed her BCom Hons (Economics and Risk Management) studies at the North West University. She joined our team in January 2016 and currently holds the title ‘Information Compliance Advisor’. She specialises in POPI and PAIA compliance, which includes compiling and submitting PAIA Manuals to the Human Rights Commission. She also compiles the Data and Information Protection Report to identify risks associated with information security and drafts Information Security policies for procedural compliance in each department within an organisation.