• Lawtons Africa

Implementation of the Protection of Personal Information Act of 2013

Updated: Jul 3

Author: Imraan Mahomed – Director and Member of the Management Board


Have you heard?

After much anticipation and a period of almost seven years, it has been officially announced that the core sections of the Protection of Personal Information Act (POPIA) will commence on 1 July 2020[1] and on 30 June 2021[2]. These core sections took effect from 1 July 2020 and organisations will be allowed twelve months to become compliant with the Act.



POPIA makes it critical for organisations that process personal information of individuals such as employees or customers, and juristic persons such as companies or trusts, to put data privacy systems in place to ensure that personal information is used only for the purposes permitted and is protected against unauthorised access or loss.


Given the wide-ranging implications of the Act and the likely impact on technology and processes, it is prudent for organisations to begin preparations as soon as possible to ensure compliance can be achieved within the relatively short phasing-in period of 12 months.


We advise that organisations should begin a review of their personal information processing systems to ensure compliance with the Act’s obligations in order to avoid the significant civil and criminal sanctions associated with non-compliance.


How to get started

Organisations should assess the amount of preparation needed to ready themselves for the implementation of the Act by considering the following steps, at a minimum:

  • Audit policies and processes used to collect, record, store, disseminate and destroy personal information.

  • Define the purpose of the information gathered and processed.

  • Limit the processing parameters.

  • Take steps to notify the data subjects.

  • Check the rationale for any further processing.

  • Ensure information quality.

  • Notify the Information Protection Regulator.

  • Accommodate data subject requests.

  • Retain records for required periods.

  • Consider data that is being transferred across borders.

The Act creates burdensome and time-consuming obligations to ensure systems and processes are compliant and set up a compliance framework. Our specialists are available to assist your organisation in becoming POPIA compliant.

[1] Sections 2 to 38; 55 to 109, 111,114 (1,2&3) to implemented on 1 July 2020.

[2] Sections 110 &114(4) to be implemented on 30 June 2021

For more information on how we can assist you, please contact our Employment Law team:

Imraan Mahomed

Director & Member of the Management Board

imraan.mahomed@lawtonsafrica.com


Jean Ewang

Director

jean.ewang@lawtonsafrica.com


Jordyne Löser

Associate

jordyne.loser@lawtonsafrica.com

Bongani Masuku

Director

bongani.masuku@lawtonsafrica.com


Lavery Modise

Consultant

lavery.modise@lawtonsafrica.com

Phetheni Nkuna

Director

phetheni.nkuna@lawtonsafrica.com

Hedda Schensema

Director

hedda.schensema@lawtonsafrica.com

Lawtons Africa is a South African law firm. With roots that grew out of seeds sown in down-town Johannesburg in 1892, our history features various changes and different names. Our team of approximately 70 lawyers, including directors, consultants, associates and candidate attorneys is highly qualified, market-recognised and skilled. For further information, visit www.lawtonsafrica.com

  • LinkedIn - Grey Circle
  • Facebook - Grey Circle
  • Twitter - Grey Circle

T. +27 11 286 6900   |  F. +27 11 286 6901  |  Lawtons Africa, 140 West St, Sandton, Johannesburg, 2196

© 2019 LAWTONS AFRICA. All rights reserved.