South AfricaProtection of Personal Information Act, rights of data subjects
POPIA, ss. 18, 23-25 and 69-70 (the information notice, access and correction, and direct marketing)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Consent
- Audit expectation
- none
What it requires
- Before or when you collect personal information, tell the data subject what is being collected and its source, your identity, the purpose of collection, whether supplying it is voluntary or mandatory, any intended transfer to another country, and their rights of access, correction, objection and complaint to the Information Regulator.NIST Privacy FrameworkCM.AW-P1
- On request, confirm free of charge whether you hold a data subject's personal information, and give access to the record within a reasonable time, in a reasonable manner and an understandable form.NIST Privacy FrameworkCT.DM-P1
- Correct or delete personal information a data subject shows is inaccurate, irrelevant, out of date, incomplete, misleading or unlawfully obtained, and tell the data subject what action you took.NIST Privacy FrameworkCT.PO-P3
- Do not process personal information for direct marketing by electronic communication unless the data subject has consented, or is an existing customer given a free and simple chance to opt out at collection and on every marketing contact afterward.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Give a person listed in a public subscriber directory a free opportunity to object to the use of their personal information before including it.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
What the log must hold
Access record
Logging duty
Section 23(1)(b) lets a data subject, after proving identity, ask a responsible party for the record or a description of the personal information it holds, including the identity of every third party, or category of third parties, who has or has had access to it. A responsible party can answer that only from a record of who received or reached the information. The section sets no retention period and gives no regulator access to the record. Section 18 (the notice at collection), section 24 (correction) and sections 69 and 70 (direct marketing and directories) ask for no log or record.
- Kind
- Implicit
- As of
- Provision
- Section 23(1)(b)
- Trigger
- personal_data_processing
What this law does
Section 18 requires a responsible party, when it collects personal information, to take reasonably practicable steps to tell the data subject what is being collected and its source, the responsible party's identity, the purpose of collection, whether supplying the information is voluntary or mandatory, any transfer intended to a third country, and the data subject's rights of access, correction, objection and complaint to the Information Regulator; section 5 catalogues this and the Act's other data subject rights together.
Section 23 gives a data subject the right to confirm, free of charge, whether a responsible party holds their personal information and to access the record within a reasonable time, in a reasonable manner and an understandable form, and section 24 requires the responsible party to correct or delete personal information the data subject shows is inaccurate, irrelevant, out of date, incomplete, misleading or unlawfully obtained, and to tell the data subject what action was taken.
Section 69 prohibits processing personal information for direct marketing by electronic communication unless the data subject has consented or is an existing customer given a free and simple opportunity to object at collection and on every later marketing contact, and section 70 requires a public subscriber directory to give a data subject the chance to object, free of charge, before including their information.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .