South AfricaProtection of Personal Information Act 4 of 2013 (POPIA)
Protection of Personal Information Act 4 of 2013 (POPIA) ss. 1-21, 36-38 and 55-59 (application, the general conditions for lawful processing, exemptions, the Information Officer and prior authorisation)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Retention, Security, Governance, Licensing
- Audit expectation
- none
What it requires
- Obtain a lawful basis, such as the data subject's consent, before processing personal information, and limit processing to the purpose for which it was collected.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P1
- Secure the integrity and confidentiality of personal information in your possession with appropriate technical and organisational measures, identify the foreseeable risks to it, and keep those measures updated as risks change.NIST Privacy FrameworkPR.DS-P5
- Where an operator processes personal information on your behalf, bind it by written contract to the same security measures, and require it to notify you immediately if it has reasonable grounds to believe the information was accessed or acquired by an unauthorised person.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkCM.AW-P7
- Do not retain a record of personal information longer than the purpose for which it was collected requires, and destroy, delete, or de-identify it as soon as reasonably practicable once you are no longer authorised to keep it.NIST Privacy FrameworkCT.DM-P5
- Register your information officer with the Information Regulator before that officer takes up duties under the Act.NIST Privacy FrameworkGV.PO-P3
- Obtain the Information Regulator's prior authorisation before linking data subjects' unique identifiers across responsible parties, processing criminal-behaviour or credit-reporting information, or transferring special personal information or a child's information to a country without adequate protection.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- ID.RA-03Internal and external threats to the organization are identified and recorded
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Section 17 requires a responsible party to maintain the documentation of all processing operations under its responsibility, which is a register of processing. Section 11(2)(a) puts the burden of proof for consent on the responsible party, so it must be able to show the consent it relies on. Section 14(3) makes a party that used a record to decide about a data subject keep it long enough for the data subject to ask for access, which limits the personal data and is not a rule about a log. Section 19(2)(c) has the party regularly verify its security safeguards, a check on the safeguards and not on a kept record, with no cadence or reviewer. The cited sections give the Regulator no power to demand the documentation. The hook lists only the domiciled-in-the-Republic prong of section 3(1)(b); the prong that turns on where processing means are located takes no hook value.
- Kind
- Explicit
- As of
- Provision
- Sections 17 and 11(2)(a)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Section 3 applies the Act to personal information entered in a record by a responsible party domiciled in the Republic, or using automated or non-automated means there, and section 4 lists the eight conditions for lawful processing that Chapter 3 sets out: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.
Section 8 makes the responsible party accountable for those conditions from when it fixes the purpose and means of processing through the processing itself, and sections 9 to 12 require processing to be lawful, not excessive for its purpose, grounded in the data subject's consent or another listed basis, and ordinarily collected directly from the data subject.
Sections 13 to 16 limit collection to a specific and explicit purpose, bar retaining a record longer than that purpose needs, require further processing to stay compatible with the original purpose, and require the information to be kept complete, accurate and updated.
Sections 19 to 21 require a responsible party to secure the integrity and confidentiality of personal information with appropriate technical and organisational measures against loss, damage or unlawful access, to identify foreseeable risks and keep the safeguards updated, and to bind any operator it uses to the same measures by written contract.
Sections 36 to 38 let the Information Regulator exempt processing that serves the public interest, or clearly benefits the data subject, from one or more of these conditions. Section 55 bars an information officer from taking up duties under the Act until the responsible party has registered that officer with the Regulator.
Sections 57 to 59 require the Regulator's prior authorisation, on pain of prosecution for failing to notify, before processing that links unique identifiers across responsible parties, handles criminal-behaviour or credit-reporting information, or transfers special personal information or a child's information to a country without adequate protection.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .