On 22 June 2020 President Ramaphosa announced that the majority of the remaining provisions of the Protection of Personal Information Act No. 04 of 2013 (“POPIA”) are set to commence. This announcement comes more than 6 years since the initial provisions of POPIA came into effect in April 2014. The reason for this delay is due to the additional provisions of POPIA requiring a state of operational readiness in order for the Information Regulator to assume its powers, functions and duties in terms of POPIA.
With effect from 01 July 2020 the following sections of POPIA will come into effect:
- Sections 2 to 38;
- Sections 55 to 109;
- Section 111; and
- Section 114(1), (2) and (3),
collectively referred to as the (“Essential Provisions”).
The Essential Provisions of POPIA include, inter alia, the following:
- the conditions for the lawful processing of personal information;
- the regulation of the processing of special personal information;
- the appointment and obligations of the information officer;
- codes of conduct issued by the Information Regulator;
- procedures for dealing with complaints;
- provisions regulating direct marketing by means of unsolicited electronic communication;
- provisions regarding the transfer of personal information outside of South Africa;
- offences, penalties and administrative fines; and
- general enforcement of POPIA.
Section 114(1) of POPIA is imperative as it states that all forms of processing of personal information must, within 1 year after the commencement of the relevant section, be made to conform with the provisions of POPIA. This means that private and public bodies who process personal information will have until 30 June 2021 to comply with the Essential Provisions of POPIA.
Notwithstanding the above transition period, private and public bodies are encouraged to commence complying with the provisions of POPIA as soon as possible.
Sections 110 (pertaining to amendment of laws) and 114(4) (pertaining to transitional arrangements of certain powers from the South African Human Rights Commission to the Information Regulator) of POPIA will only commence on 30 June 2021.
POPIA seeks to achieve the protection of personal information processed by public and private bodies and will aim to restore the balance between right to privacy and the right of access to information. Failure to comply with the provisions of POPIA can result in the implementation of fines or even criminal prosecution.
With the countdown to POPIA compliance beginning to tick, VDMA is available to assist you and your business with your POPIA compliance needs and we are at your disposal regarding any queries you may have regarding POPIA.
Published: 24 June 2020