What is the Protection of Personal Information Act


POPI, the protection of personal information act, is a piece of legislation designed to protect any personal information which is processed by both private and public bodies (including government). The purpose of POPI is to ensure that all South African institutions who collects, stores, shares and otherwise modifies or processes information conducts itself in a responsible manner under POPI and comply with the conditions required for the lawful processing of personal information, by holding them accountable should they abuse or compromise personal information in any way. 

Given the fact that POPI considers one’s personal information to be of great value, it grants to the owner of such personal information the rights of protection thereof. Personal information is any information relating to a living natural person or an identifiable legal entity and includes, amongst others, information such as names, birth dates, identity/registration numbers, passport numbers, demographic information, occupational information, health information, contact information to name only a few.

It is important to note, however, that information cannot be considered as "personal information" if it is already in the public domain or is not used, or intended to be used, in trade or commerce.

POPI affords protection to the “data subject”, who is the natural or juristic entity to whom the personal information relates. This may be anyone, including new or existing clients, prospective clients, suppliers or any other person whose personal information is being processed by your organisation.

POPI establishes the “responsible party” who is the party or organisation that must comply with the provisions of POPI. This concept refers to the parties that processes the personal information and determines the purpose for which the personal information is needed.

We live in an information age, it still remains the responsibility of each person to take care of their personal information and to avoid publishing of such information on social media platforms, such as Facebook, Twitter and LinkedIn. Someone else cannot be accused of publishing or sharing your personal information if the very same information can be found on social media platforms.

A few limited sections of POPI have already commenced (under proclamation No. R. 25, 2014), however the majority of POPI (especially the sections that create compliance requirements) will only commence on a later date to be proclaimed by the President, which might be towards the end of 2018.