# Regulatory Standards — South Africa POPIA

## Primary Legislation

### Protection of Personal Information Act (POPIA), Act No. 4 of 2013

- **Section 1**: Definitions — responsible party, operator, data subject, personal information, special personal information, processing
- **Sections 8-25**: Eight Conditions for Lawful Processing (Accountability, Processing Limitation, Purpose Specification, Further Processing Limitation, Information Quality, Openness, Security Safeguards, Data Subject Participation)
- **Section 11**: Consent requirements — voluntary, specific, informed; data subject may withdraw consent
- **Sections 26-33**: Processing of Special Personal Information — religious beliefs, race, trade union membership, political persuasion, health, sex life, biometric, criminal behaviour
- **Section 34**: Processing of Personal Information of Children — prohibited unless with consent of competent person or required by law
- **Section 55-56**: Information Officer designation and registration with the Information Regulator
- **Section 57**: Deputy Information Officers — delegation of functions
- **Section 69-71**: Automated Decision Making — data subject has the right not to be subject to a decision based solely on automated processing
- **Section 72**: Transborder Information Flows — conditions for cross-border transfer of personal information
- **Section 22**: Notification of Security Compromises — responsible party must notify the Information Regulator and data subjects as soon as reasonably possible
- **Section 99-106**: Civil Remedies — data subjects may institute civil action for damages suffered
- **Section 107**: Offences — hindering, obstruction, unlawful acts carry criminal penalties
- **Section 109**: Administrative fines — up to ZAR 10 million

### Constitution of the Republic of South Africa, 1996

- **Section 14**: Right to privacy — "Everyone has the right to privacy, which includes the right not to have (a) their person or home searched; (b) their property searched; (c) their possessions seized; or (d) the privacy of their communications infringed."
- **Section 32**: Right of access to information — underpins the Promotion of Access to Information Act (PAIA) interaction with POPIA

### Promotion of Access to Information Act (PAIA), Act No. 2 of 2000

- PAIA governs access to information held by public and private bodies
- POPIA Section 110 amends PAIA to include privacy protections
- Information Officers under POPIA also serve as PAIA Information Officers

## Information Regulator Guidance

### Guidance Note on Applications for Prior Authorisation (2022)
- Processing of special personal information, automated decision-making, and large-scale processing of children's data require prior authorisation under Section 57
- Application process and assessment criteria published by the Information Regulator

### Guidance Note on Information Officers (2021)
- Every responsible party must designate an Information Officer
- Public bodies: the head of the body is the Information Officer by default
- Private bodies: must register Information Officers with the Information Regulator via the prescribed form

### Code of Conduct for Credit Bureaus (2022)
- First sectoral code issued under Section 60
- Establishes specific processing rules for credit bureau personal information
- Includes enhanced data subject rights for credit information

## International Frameworks and Comparisons

### African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention, 2014)
- South Africa is a signatory; POPIA aligns with Malabo Convention principles
- Convention requires establishment of national data protection authorities
- Provides framework for cross-border data flow within the African Union

### SADC Model Law on Data Protection (2013)
- Southern African Development Community framework informing regional harmonisation
- POPIA is considered the benchmark implementation within the SADC region

### ISO/IEC 27701:2019 — Privacy Information Management
- Extends ISO 27001/27002 to include privacy management
- Supports POPIA Condition 7 (Security Safeguards) compliance demonstration
- Information Regulator recognises certification as evidence of reasonable security measures