POPI is shorthand for the Protection of Personal Information Act No. 4 of 2013. Signed into law on November 19, 2013, parts of the law became effective on April 11, 2014. The President proclaimed the effective date of the POPI Act to be 1 July 2020. When the Act became formal law 1 July 2020, it included a grace period of 12 months for businesses to update their systems.

In essence, POPI applies conditions for the lawful processing of personal data of South Africans (both South African citizens and those living in South Africa). It includes eight general conditions and three less descript conditions.

POPI makes responsible parties culpable for failures among those who process data on their behalf.

It also provides South Africans with rights regarding unsolicited electronic communications.

POPI differs from other privacy laws in several ways, but the biggest difference lies in consent.

Who Does POPI Apply to?

POPI applies to data processors or responsible parties who are either domiciled in the Republic of South Africa or who are domiciled elsewhere but “makes use of automated or non-automated means” in South Africa.

“Automated” refers to using equipment that processes information automatically according to a data processor’s instructions.

POPI regulates your business’s use of personal information. According to the text, personal information is:

“Information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person.”

What does this mean for YOU?

The POPI Act allows for any data subject (employee, student or stakeholder) to access and see personal information that is kept about them. Your consent is needed to collate, use, and disseminate any personal information you share with any office at the college. You have the right to know how your personal information is safeguarded, and to object to the use of your personal information (which includes images). Forms have been developed, which allow you to request to see your personal information, ask how it is safeguarded, or for you to object to the use of your personal information in a specific media or format for a specific reason.