Understanding the POPI Act – what exactly is Personal Information and the processing thereof?

The year 2021 to date has been a year in which companies had to scramble to become compliant with the Protection of Personal Information Act 4 of 2013 (POPIA). Many businesses did not know whether they are exempted from the POPI Act or whether they even processed personal information.

According to POPIA, personal information is information relating to an identifiable, living, natural person and, where applicable, an identifiable, existing juristic person. A juristic person includes a company, trust or close corporation. But what exactly does this mean? 

Processing of Personal Information by a company

A company “processes” personal information if it collects, receives, records, organises, combines, stores, updates, modifies, retrieves, alters, consults, uses, transfers, distributes, makes available, merges, links, restricts, degrades, erases or destroys the information – thus, any personal information that a company merely collects, for example, and where information can be linked to a natural or juristic person, must meet the requirements for processing personal information. Information that identifies a natural or juristic person could be as simple as a name in conjunction with a cell phone number or it can be more complex, such as an IP (Internet Protocol) address or cookie identifier.

What is Special Personal Information?

Personal information is a broader category than special personal information which is a more specific category of personal information, such as the religious or philosophical beliefs, race, ethnic origin, trade union membership, political persuasion, health, sex life, biometrics or the criminal behaviour of a data subject. This information is more sensitive; therefore, POPIA prescribes additional requirements if this type of information is processed.

If your company processes any of the following, you need to be POPIA compliant.

Information of a natural or juristic person’s–

• education, physical health, mental health, finances, criminal or employment history;
• ID number, symbol, email address, physical address, telephone number, location or online identifier;
• names, surname, birth date or beliefs;
• biometrics;
• personal opinions, views or preferences;
• views or opinions about the data subject;
• gender, age, sex, pregnancy, marital status or sexual orientation;
• national, ethnic or social origin, race or colour; and
• well-being, disability, religion, conscience, culture or language.

Any information that cannot be linked back to a living natural or juristic person counts as non-personal information, although such information may still be confidential.

There are times when personal information does not need to be protected under POPIA. This is when a natural or juristic person has placed that information within the public domain, which means that if the information that a company has collected and processes was taken from the public domain, for example Facebook, Instagram, LinkedIn, Tik-Tok, etc., it does not have to be protected under POPIA as it was made public by the data subjects themselves. Any company or individual therefore has access to such information. Another scenario where information is not protected under POPIA is when a company is exempted  by the Information Regulator or when government or law enforcement agencies require such information in the execution of their statutory mandates.

In conclusion

If you do process any of the above-listed information and are not exempted in terms of section 19 of POPIA, “A responsible party must secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organizational measures”, meaning that the responsible party must–

• identify all internal and external risks;
• establish and maintain safeguards against those identified risks;
• regularly monitor those safeguards to ensure that they are still effective; and
• update those safeguards regularly.

SERR Synergy assists businesses in ensuring that personal information is processed in accordance with legislation, while simultaneously serving the needs of your business with regard to the role such information plays in your business operations.  We provide a full range of Information Compliance service offerings, be it conducting POPI audits, compiling POPIA due diligence reports; drafting the required privacy policies, advising on internal information-handling requirements, or providing training to employees to ensure an understanding of POPIA.

About the Author: Gisela du Plessis obtained her BEd degree at the University of Pretoria. She joined SERR Synergy in 2021 and currently holds the title of Information Compliance Advisor, specialising in compliance with the Consumer Protection Act (CPA), POPIA and PAIA.