WHAT IS THE POPI ACT?

Why does it matter to me and my eCommerce site?

The Protection of Personal Information Act 4 of 2013 (POPI Act) is a piece of legislation aimed at regulating the processing (collecting, sharing, using etc) of personal information in a manner which gives effect to people’s right to privacy. Compliance date is 1 July 2021.
Registration is on the POPI Portal at www.justice.gov.za

WHAT IS PROCESSING?

Any activity concerning personal information, e.g.

The collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration
consultation or use.

Dissemination by means of transmission, distribution or making available in any other form.

Merging, linking, restriction, degradation, erasure or destruction of information.

Very broad and basically covers anything you do with the information.

NOTIFYING PEOPLE WHO YOU COLLECT PERSONAL INFORMATION FROM

Whenever you collect information from anyone (data subject), you need to notify the data subject of the following:

  1. The information being collected;
  2. The name and address of the responsible party;
  3. The purpose for which the information is being collected;
  4. Whether supply of the information is voluntary or mandatory;
  5. The consequences of failure to provide the information;
  6. Recipient or category of recipients of the information;
  7. Existence of the right of access to and the right to rectify the information collected;
  8. Existence of the right to object to the processing of personal information;
  9. Right to lodge a complaint to the Information Regulator

EIGHT CONDITIONS

POPI sets conditions for Responsible Parties to lawfully process the personal information of data subjects (both natural and Juristic persons).

ACCOUNTABILITY

Responsible parties must comply with the law / 8 conditions.

PROCESSING LIMITATION

Personal information should be obtained by only lawful processing that does not unnecessarily infringe privacy. Only collect what you are entitled to.

PURPOSE SPECIFIC

The purpose for which personal information is collected must be specific, explicitly defined and lawful. Do not retain information for longer than is necessary.

FURTHER PROCESSING

Further processing must be compatible with the purpose for which personal information is collected. You will be restricted with regard to what else you do with the personal information.

INFORMATION QUALITY

Reasonably practical steps to ensure Personal Information is complete, accurate, not misleading and updated. You need to keep the personal information updated and correct.

OPENNESS

Advise the data subject of certain mandatory information in regard to the collection. Tell the data subject what you will do with their personal information. What, who and purpose for collection. If it is mandatory or voluntary? Inform them of the consequence of failure to provide the necessary information.

SECURITY

The integrity and confidentiality of the Personal Information must be secured. Take appropriate, reasonable technical and organisational measures to prevent loss / damage of PI and
unlawful access or processing of PI.

DATA SUBJECT PARTICIPATION

The data subject as certain access rights, including a right to request its deletion. Inform and allow data subjects to access their personal information on request.

IN SHORT…

Section 69 defines electronic direct marketing to include SMS and E-Mail marketing.
For non-customers, you need consent to do electronic direct marketing, you have one chance to get consent.
This means you have the option to call each data subject (contact) once, to ask for consent. You may only call data subjects who have not already opted out.
You need to be transparent in your request for consent.


If you obtained personal information directly from your existing customers, a reasonable opportunity needs to be given to them to allow them to opt out should they wish to.
You need to have a system in place whereby Opt-In and Opt-Outs are recorded.


Get your information directly from the regulator at https://www.justice.gov.za/inforeg/