On this page
Quick answer: POPIA controls how you collect, use, store, share and delete personal information. Collect only what you need for a clear purpose, tell people about it, keep it secure, let them access or correct it, register your Information Officer, and get consent before electronic marketing to people who aren't customers.
What counts as personal information
Information that identifies a living person, such as names, ID numbers, contact details, addresses, photos and online identifiers. In South Africa, POPIA also protects information about existing juristic persons such as companies. Some information is "special", for example health, religion or biometric data, and has stricter rules.
The core conditions, in plain terms
| Condition | What it means for you |
|---|---|
| Accountability | Your business is responsible for complying |
| Processing limitation | Collect only what you need, lawfully, ideally directly from the person |
| Purpose specification | Collect for a specific purpose and don't keep it longer than needed |
| Further processing | Don't use it for unrelated purposes |
| Information quality | Keep it accurate and up to date |
| Openness | Tell people what you collect and why, for example in a privacy policy |
| Security safeguards | Protect it against loss, damage and unauthorised access |
| Data subject participation | Let people access and correct their information |
Your Information Officer
Every business has an Information Officer. For a company, it is the chief executive officer or equivalent officer by default, who may authorise someone else in the business to act in the role. The Information Officer must be registered with the Information Regulator, on its eServices portal, before taking up their duties.
Direct marketing
Marketing by email, SMS or automated calls to people who aren't your customers needs their consent first, and you may only ask them for consent once. Existing customers can receive marketing about your own similar products if they were given a chance to opt out when you collected their details and are given one in every message. Every marketing message must identify you and say how to stop receiving them.
Sending information abroad
Many cloud services store data outside South Africa. POPIA allows transfers to a third party in another country when, for example, the recipient is bound by laws or agreements giving adequate protection, the person consents, or the transfer is needed to perform a contract with them. Say in your privacy policy where information goes.
If information is compromised
If you reasonably believe personal information has been accessed by an unauthorised person, you must notify the Information Regulator and the affected people as soon as reasonably possible.
A practical starting list
- Register your Information Officer
- Publish a privacy policy
- Collect only what each form really needs
- Secure your website forms and admin logins
- Agree with suppliers who handle your customers' data how they protect it
Web Development from Digitalx, priced in writing before we start.