Author: Imraan Mahomed – Director and Member of the Management Board
Have you heard?
After much anticipation and a period of almost seven years, it has been officially announced that the core sections of the Protection of Personal Information Act (POPIA) will commence on 1 July 2020[1] and on 30 June 2021[2]. These core sections took effect from 1 July 2020 and organisations will be allowed twelve months to become compliant with the Act.
POPIA makes it critical for organisations that process personal information of individuals such as employees or customers, and juristic persons such as companies or trusts, to put data privacy systems in place to ensure that personal information is used only for the purposes permitted and is protected against unauthorised access or loss.
Given the wide-ranging implications of the Act and the likely impact on technology and processes, it is prudent for organisations to begin preparations as soon as possible to ensure compliance can be achieved within the relatively short phasing-in period of 12 months.
We advise that organisations should begin a review of their personal information processing systems to ensure compliance with the Act’s obligations in order to avoid the significant civil and criminal sanctions associated with non-compliance.
How to get started
Organisations should assess the amount of preparation needed to ready themselves for the implementation of the Act by considering the following steps, at a minimum:
Audit policies and processes used to collect, record, store, disseminate and destroy personal information.
Define the purpose of the information gathered and processed.
Limit the processing parameters.
Take steps to notify the data subjects.
Check the rationale for any further processing.
Ensure information quality.
Notify the Information Protection Regulator.
Accommodate data subject requests.
Retain records for required periods.
Consider data that is being transferred across borders.
The Act creates burdensome and time-consuming obligations to ensure systems and processes are compliant and set up a compliance framework. Our specialists are available to assist your organisation in becoming POPIA compliant.
[1] Sections 2 to 38; 55 to 109, 111,114 (1,2&3) to implemented on 1 July 2020.
[2] Sections 110 &114(4) to be implemented on 30 June 2021
For more information on how we can assist you, please contact our Employment Law team:
Director & Member of the Management Board
imraan.mahomed@lawtonsafrica.com
Director
jean.ewang@lawtonsafrica.com
Associate
jordyne.loser@lawtonsafrica.com
Director
bongani.masuku@lawtonsafrica.com
Consultant
lavery.modise@lawtonsafrica.com
Director
phetheni.nkuna@lawtonsafrica.com
Director
hedda.schensema@lawtonsafrica.com
Lawtons Africa is a South African law firm. With roots that grew out of seeds sown in down-town Johannesburg in 1892, our history features various changes and different names. Our team of lawyers, including directors, consultants, associates and candidate attorneys is highly qualified, market-recognised and skilled. For further information, visit www.lawtonsafrica.com