South African Cyber Law
Protection of Personal Information Act (POPIA)
The Protection of Personal Information Act 4 of 2013, commonly called POPIA, establishes conditions for the lawful processing of personal information and provides rights and remedies relating to personal information.
What POPIA covers
POPIA regulates the processing of personal information and establishes conditions intended to protect personal information while balancing legitimate interests.
Processing is broader than simply storing data. The Act covers activities such as collection, receipt, recording, organisation, storage, use, transmission, distribution, making available and deletion or destruction.
POPIA also establishes the Information Regulator and provides mechanisms through which rights and complaints can be dealt with.
The eight conditions
POPIA sets out eight conditions for lawful processing: accountability; processing limitation; purpose specification; further processing limitation; information quality; openness; security safeguards; and data subject participation.
These conditions operate together. Compliance is not simply a matter of obtaining consent and then doing anything with the information.
Personal information is broad
The Act’s definition covers a wide range of information relating to an identifiable, living natural person and, in relevant circumstances, an identifiable existing juristic person.
Examples include names and identifiers, contact details, location information, online identifiers and biometric information.
POPIA is not only about data breaches
Security incidents are an important part of information protection, but POPIA also deals with collection, purpose, use, disclosure, retention, openness and data-subject participation.
An organisation can therefore have a POPIA issue even when no security breach has occurred.
Official source
Read the official legislation from the South African government:
Protection of Personal Information Act 4 of 2013 — South African Department of JusticeImportant
Cyber Conduct provides general educational information, not legal advice. South African legislation can change, and the application of the law depends on the facts of each situation. For a specific legal matter, consider obtaining advice from a qualified legal professional or the relevant authority.