The latest developments on the commencement of the Protection of Personal Information Act, 2013

On 22 June 2020, the President published a statement indicating that further provisions of POPI would come into force. These provisions are the following:

• sections 2 to 38; sections 55 to 109; section 111 and section 114(1), (2) and (3) which shall commence on 1 July 2020; and
• sections 110 and 114(4) which shall commence on 30 June 2021.

The sections which are due to commence on 1 July 2020 form the core provisions of POPI and relate to, amongst other things, the application of the Act; the processing of personal information and special personal information (and the conditions under which such processing may occur); the duties and responsibilities of the Information Officer; the rights of data subjects pertaining to direct marketing; the regulation of the transborder flow of information outside of the Republic of South Africa; and the enforcement of the provisions of POPI (including imposing of penalties and administrative fines).

Section 114(1), which is also due to come into force on 1 July 2020, provides that persons have a grace period of one year to ensure that their processing of personal information complies with the provisions of POPI. Although this one-year grace period has been given, the President has advised that private and public bodies should attempt to comply with the provisions of POPI as soon as possible.

It has been our experience that complying with the various aspects and conditions of POPI takes time, not only to implement within an organisation, but to ensure that the relevant systems provide the necessary security safeguards. We are therefore in agreement with the President’s statement that private and public bodies should not delay in kickstarting the process of complying with POPI’s procedures. Any delay may result in private and public bodies being in a position that they are unable to implement the necessary changes to their organisation within the grace period provided and as such they may find themselves in a position whereby they are in breach of the legislation as a result of non-compliance.

The President has indicated that the rationale for the delay in sections 110 and 114(4) coming into force, is due to the fact that these sections require the amendment of certain laws (including certain provisions of the Promotion of Access to Information Act 2 of 2000 (PAIA)) and also require the South African Human Rights Commission to consult with the Information Regulator with regards to certain aspects of PAIA.

With the substantial provisions of POPI due to commence on 1 July 2020, it is more important than ever to ensure that your processing of personal information complies with these provisions. Please contact us should you require any assistance in understanding the application of POPI to your organisation and the measures which you will need to put in place in order to ensure compliance.