24 June 2020 by Corporate & Commercial Alert

The latest developments on the commencement of the Protection of Personal Information Act, 2013

The Protection of Personal Information Act 4 of 2013 (POPI) was enacted into law on 26 November 2013 with an indication that the President of the Republic of South Africa would determine the date upon which such Act would come into force and effect. From the date of its enactment until now, the only provisions which have come into force relate to the definitions, the establishment of the office of the Information Regulator (as well as its powers, duties and functions) and the introduction of regulations (which came into force on 11 April 2014).

On 22 June 2020, the President published a statement indicating that further provisions of POPI would come into force. These provisions are the following:

  • sections 2 to 38; sections 55 to 109; section 111 and section 114(1), (2) and (3) which shall commence on 1 July 2020; and
  • sections 110 and 114(4) which shall commence on 30 June 2021.

The sections which are due to commence on 1 July 2020 form the core provisions of POPI and relate to, amongst other things, the application of the Act; the processing of personal information and special personal information (and the conditions under which such processing may occur); the duties and responsibilities of the Information Officer; the rights of data subjects pertaining to direct marketing; the regulation of the transborder flow of information outside of the Republic of South Africa; and the enforcement of the provisions of POPI (including imposing of penalties and administrative fines).

Section 114(1), which is also due to come into force on 1 July 2020, provides that persons have a grace period of one year to ensure that their processing of personal information complies with the provisions of POPI. Although this one-year grace period has been given, the President has advised that private and public bodies should attempt to comply with the provisions of POPI as soon as possible.

It has been our experience that complying with the various aspects and conditions of POPI takes time, not only to implement within an organisation, but to ensure that the relevant systems provide the necessary security safeguards. We are therefore in agreement with the President’s statement that private and public bodies should not delay in kickstarting the process of complying with POPI’s procedures. Any delay may result in private and public bodies being in a position that they are unable to implement the necessary changes to their organisation within the grace period provided and as such they may find themselves in a position whereby they are in breach of the legislation as a result of non-compliance.

The President has indicated that the rationale for the delay in sections 110 and 114(4) coming into force, is due to the fact that these sections require the amendment of certain laws (including certain provisions of the Promotion of Access to Information Act 2 of 2000 (PAIA)) and also require the South African Human Rights Commission to consult with the Information Regulator with regards to certain aspects of PAIA.

With the substantial provisions of POPI due to commence on 1 July 2020, it is more important than ever to ensure that your processing of personal information complies with these provisions. Please contact us should you require any assistance in understanding the application of POPI to your organisation and the measures which you will need to put in place in order to ensure compliance.

download PDF

The information and material published on this website is provided for general purposes only and does not constitute legal advice.

We make every effort to ensure that the content is updated regularly and to offer the most current and accurate information. Please consult one of our lawyers on any specific legal problem or matter.

We accept no responsibility for any loss or damage, whether direct or consequential, which may arise from reliance on the information contained in these pages.

Please refer to the full terms and conditions on the website.

Copyright © 2020 Cliffe Dekker Hofmeyr. All rights reserved. For permission to reproduce an article or publication, please contact us cliffedekkerhofmeyr@cdhlegal.com

You may also be interested in