POPIA Protection of Personal Information Act

POPIA is South Africa’s data protection statute, broadly comparable in intent to the GDPR. It governs how a responsible party, the equivalent of a controller, may process the personal information of a data subject, and it became fully enforceable in July 2021. It applies to processing carried out by parties domiciled in South Africa, and to those outside it who process information within the country.

Lawful processing rests on eight conditions: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. Security safeguards is the condition that turns into engineering work, requiring a responsible party to secure the integrity and confidentiality of personal information through appropriate and reasonable technical and organizational measures.

Breach duties are explicit. Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovery. Notification to data subjects must describe the possible consequences and what the organization intends to do about it, which presumes you can establish what was actually reached.