POPI’s draft regulations have been published

They are simple and clear to understand. Don’t miss your opportunity to comment.

They are simple and clear to understand. Don’t miss your opportunity to comment.

Earlier this year, during a stakeholder briefing, South Africa’s Information Regulator chairperson promised to have draft Protection of Personal Information Act regulations out before the end of 2017.  She has kept her word: draft POPIA (the Information Regulator prefers this acronym) regulations were published on Friday 8 September 2017.

POPIA’s main objective is to protect people’s personal information.  It was passed into law in 2013, but is not yet fully effective.

The draft regulations set out, in more detail, steps and procedures that are required in order to comply with POPIA.  What is clear from the draft regulations is that they are intended to be simple and uncomplicated.  This is, in our view, an excellent approach: considering South Africa’s demographics, the last thing we need is a convoluted process that makes it difficult for the average person to protect their rights.

The draft regulations expand on and regulate a number of administrative and procedural steps and obligations that POPIA imposes.  These steps include:

  • how to object to the processing of personal information;
  • how to request the correction, deletion or destruction of personal information;
  • the duties and responsibilities of Information Officers;
  • how to apply for a code of conduct
  • how to request a person’s permission to send them unsolicited direct marketing;
  • grievance or compliance submission processes; and
  • how to request the Information Regulator’s assistance as a conciliator during an investigation.

In our view, organisations should focus on those aspects related to the duties and responsibilities of Information Officers.  Regulation 4 sets out these duties, the first of which is to ensure that a compliance framework is developed, implemented and monitored.  This is where organisations that are serious about compliance, should start.

POPIA is not effective yet, and will give affected parties one year to comply, from the date it becomes fully effective.

A copy of the draft regulations is available on the Information Regulator’s website.  Comments on the regulations will be accepted until 7 November 2017.

Lucien Pierce is a partner at PPM Attorneys and has been practising for 20 years.  He focuses on the protection of personal information, information security, telecommunications, media and technology law. 

Filter By

Must Reads

Subscribe to receive our latest articles

Follow Us

Related Posts

Imitation is the greatest form of flattery, but we don’t think so in this case.

We are aware of the phishing email that has been circulated to many people. Although we are not the firm mentioned in the phishing email you may have received, we’ve received several calls because of the similarity to our firm name so, unless you’d like to have a chat about other technology law matters, please don’t call us as we won’t be able to help. 

We know the firm in the phishing email is a genuine law firm, based in Cape Town, and we’ve alerted them to what is likely an impersonation scam.

If you’d like to learn more about phishing, click on the following link (we promise this is a legitimate link ) to watch this entertaining video we did eight years ago.