Legal Articles

The Protection of Personal Information Act in South Africa was set to come into force as of the 1^st of April 2020 but, due to the Coronavirus outbreak, it has been postponed until further notice.

Protection of Personal Information Act South Africa Postponed

The Protection of Personal Information Act (POPIA) refers to the way personal information may be processed by companies and other agents.

This act serves to introduce a number of new laws that will restrict the way in which companies process and use user and employee data.

However, due to the outbreak of COVID-19 in South Africa, the effective date is expected to be the 1^st of June 2020, with a 12-month grace period which ends on the 1^st of June 2021.

The information regulator has frequently mentioned that the POPIA cannot commence until the regulator is fully operational. This process has been delayed due to the immense workload that must be completed before the Act can commence.

In other words, there must be an established information regulator in office in order to effectively manage the transition from the grace period to the full implementation of the POPIA and, given the current trajectory, this will not happen before the end of May 2020.

Purpose of Protection of Personal Information Act

This Act will bring amount a number of serious changes to South African businesses, placing a much-needed limit on the way businesses use the personal information of South African consumers.

This means that citizens will be given more control over the privacy of their information, resulting in fewer spam calls and reduced exposure of their personal data to various companies.

Although there are certain provisions of the act already in force, the most important provisions that deal with direct marketing have not yet been put into place.

To put it simply, “cold calling” may no longer be permitted and should companies not strictly comply with the new regulations, they will be faced with a hefty fine.

Data Protection Act South Africa

The POPIA will include specific provisions for the disclosure and processing of personal information only if:

• The data subject has given consent for the processing of his or her information
• Processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party
• Processing complies with an obligation imposed by law on the responsible party
• Processing protects a legitimate interest of the data subject
• Processing is necessary for the proper performance of a public law duty by a public body
• Processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied

In any case other than those mentioned above, personal data and information may not be processed or disclosed.

This is in order to protect South Africans against companies that would use their personal data in an exploitive manner.

Van Deventer & Van Deventer Incorporated – Attorneys in South Africa

The Protection of Personal Information Act of South Africa aims to put into place more stringent controls on how companies process user information.

However, with the outbreak of Coronavirus in the country, the commencement date of the act has been significantly delayed.

For more information on the Act and how it will protect consumer information from being exploited, please contact our attorneys.