Legal Talk: Is Your Business Ready For The Popi Act?

The Protection of Personal Information Act (POPI Act) was enacted in July 2020 with a built- in grace period of one year to allow companies to become fully compliant with its provisions. Prior to this, the way in which the personal details of a person were used, was far less stringent.

As from 1 July 2021 the provisions of the POPI Act kicks in. There is now greater protection of the personal information of the data subjects [i.e. the person to whom personal information relates], in both the public and private sector.

The manner in which personal data, including employees' information, vendors, business partners, service providers, etc. of persons are collected, stored or processed must adhere strictly to the provisions of the POPI Act.

The primary purpose of the Act is to ensure that when storing, processing, gathering, and distributing another entity's personal information, all South African entities must be held accountable if personal information of the data subject is exploited or compromised in any way.

The POPI Act sets conditions on how you can legally process personal information of a person, whether it is a natural or juristic person. This personal information is considered as being valuable possessions. The possessor of a person's personal information now has rights of protection over such information.

The Act requires businesses to implement better data and security management of the data subjects. It puts South Africa's privacy laws in line with international privacy standards.

For the customer, client or consumer it means that they are now protected from security breaches, including cyber attacks, theft, and discrimination. How companies use and store data of the customer, including email addresses etc. is now severely impacted.

POPI will affect the way you are allowed to market your business to potential customers. For example, you would need explicit consent from your customer before you are able to engage in direct marketing communication from your business. The POPI Act holds all data processors accountable, regardless of the size of their databases.

It is worth noting that the POPI Act does not stop one from processing data nor are not require you to get consent from the data subjects in order to process their personal information.

The Act requires that when personal information is processed, the person doing so is now is responsible for complying with the conditions of the Act. Businesses that do not comply face hefty fines, imprisonment, not to mention reputational damage.

Most businesses have some online activity and this means they are also vulnerable to cyber attack where the personal data of data subjects are stored or processed. Thus, small and medium enterprises (SMEs) need to ensure they are fully compliant with the provisions of POPI.

To make it easy to ensure that your business is in line with and compliant with the provisions of the POPI Act, our firm offers training to your key employees to small and medium businesses.

We can train and apprise your employees so that your business operation does not suffer any downtime in making sure it is compliant with the provisions of the POPI Act.

Don't delay , contact us on fawzia@thelawdesk.co.za or call 031- 5 025670 to set up an appointment. The Law Desk of Fawzia Khan & Associates. Giving YOU the Power of Attorney.