President announces commencement date for the protection of personal information act (“POPIA”)

The President of South Africa has proclaimed 1 July 2020 to be the commencement date of POPIA. The importance of this date is that a 1 (one) year “grace period” commences wherein all businesses, whether public or private, must comply with the conditions for the lawful processing of personal information.

The purpose of POPIA is to give effect to the fundamental right to privacy contained in section 14 of the Constitution of the Republic of South Africa, 1996, which entail the “right to protection against the unlawful collection, retention, dissemination and use of personal information”.

POPIA sets minimum requirements which all businesses must comply with when it collects, processes, stores and / or shares the personal information of individuals and businesses. Compliance with POPIA is not taken lightly as it provides for mechanisms to hold businesses accountable should they abuse or compromise personal information in any way by providing for fines of between R1 million and R10 million or imprisonment of 1 (one) to 10 (ten) years. Businesses may further be ordered to pay compensation for damages as a result of failure to comply with POPIA.

The sections of POPIA which will come into effect on 1 July 2020 are the following:

• Sections 2 to 38 which deals with:
  • 2 to 7: Application of POPIA;
  • 8 to 35: Listed conditions for lawful processing of personal information; and
  • 36 to 38: Exemption from conditions for processing of personal information.
• Sections 55 to 109 which deals with:
  • 55 to 56: Information officer;
  • 57 to 59: Prior authorisation;
  • 60 to 68: Codes of conduct;
  • 69 to 71: Rights of data subjects regarding direct marketing by means of unsolicited electronic communications, directories and automated decision making;
  • 72: Transborder information flows;
  • 73 to 99: Enforcement; and
  • 100 to 109: Offences, penalties and administrative fines.
• Section 111 which deals with fees payable by data subjects.
• Section 114(1), (2) and (3) which deals with transitional arrangements (the “grace period”).

Businesses have till 1 July 2021 to ensure that the necessary mechanisms are put in place to comply with POPIA. It is therefore advisable that businesses contact qualified advisors which are able to give proper guidance and ensure compliance with POPIA.