POPIA

This applies to you if you process personal information as part of any activity of your business. Processing is defined so widely that collecting, storing, retrieving and deleting are all processing, so merely holding a customer list is enough. Personal information covers a living natural person AND an existing juristic person, which is the part South African businesses get wrong: your supplier's registration number, bank details and trading history are personal information about that company.

Answer as the responsible party, which is whoever determines the purpose and the means of the processing. If you decide what the data is for, you are the responsible party and these duties are yours even when somebody else holds the data. If you process only on instructions from another business, you are an operator for that work, your duties are sections 20 and 21(2), and the questions here against those two sections are the ones to answer.

Most businesses are both at once, on different data. A logistics company is the responsible party for its own employee and consignee records and an operator for the sender's customer data in a consignment. A payments business is the responsible party for its KYC records and an operator for the merchant's cardholder data. Work through this assessment once per role, because the answers differ.

Section 6 is the exclusion to read before anything else. The Act does not apply to processing in the course of a purely personal or household activity, to information that has been de-identified to the point where it cannot be re-identified, or to several state functions. De-identification is the one a business can actually use, and section 1 sets the bar at deleting anything that identifies the person, can be used to re-identify them, or links them to other information. Hashed, tokenised or pseudonymised data that your own systems can reverse is not de-identified.

There is no small business exemption and no grace period left. The operative conditions commenced on 1 July 2020 and the one year transitional period under section 114(1) ended on 30 June 2021.

POPIA splits its consequences three ways, and conflating them is the most common error in South African privacy advice.

FIRST, the administrative fine. Section 109 lets the Regulator serve an infringement notice on a responsible party alleged to have committed an offence, with an administrative fine that may not exceed R10 million. The infringer has 30 days to pay, to arrange instalments, or to elect trial in court. Section 109(3) lists the eight factors the Regulator must weigh, which include the nature of the information, the number of data subjects affected, whether the contravention could have been prevented, and specifically any failure to carry out a risk assessment or to operate good policies, procedures and practices. Sections 109(6) and (7) make the fine and a prosecution mutually exclusive on the same facts.

SECOND, the criminal offences, which are a closed list. Sections 100 to 106 create seven offences: obstructing the Regulator, breaching the Regulator's duty of confidentiality, obstructing the execution of a warrant, failing to comply with an enforcement or information notice, offences by a witness, and the two account number offences. Section 107 then sets the brackets. A contravention of section 100, 103(1), 104(2), 105(1) or 106(1), (3) or (4) carries a fine or imprisonment not exceeding 10 YEARS, or both. A contravention of section 59, 101, 102, 103(2) or 104(1) carries a fine or imprisonment not exceeding 12 months, or both. Section 108 gives a magistrate's court jurisdiction to impose any of it. Note what is NOT a criminal offence: failing to secure personal information, failing to notify a security compromise, ignoring an objection, marketing without consent. None of those is in sections 100 to 106.

THIRD, and this is the route the first two actually travel through, interference with the protection of personal information under section 73. A breach of any condition for lawful processing is interference. Interference leads to a complaint under section 74, an investigation, an assessment under section 89, a referral to the Enforcement Committee and an enforcement notice under section 95. Failing to comply with the enforcement notice is then the offence in section 103(1), and that is the one in the 10 year bracket. So a security failure does not put anyone in prison. Ignoring the Regulator's notice about it can.

FOURTH, civil liability that does not depend on fault. Section 99(1) gives a data subject, or the Regulator at the data subject's request, a civil action for damages against a responsible party for interference with the protection of personal information, WHETHER OR NOT THERE IS INTENT OR NEGLIGENCE. Section 99(2) lists the only defences: vis maior, consent, fault on the plaintiff's part, compliance was not reasonably practicable, or an exemption under section 37. Section 99(3) lets the court award damages for patrimonial and non-patrimonial loss, aggravated damages, interest and costs. Strict liability plus aggravated damages is a bigger number than R10 million in a class of any size, and it is the part of POPIA that boards are least often shown.