In Episode 12 of our Inside Privacy Audiocast, together with special guest Advocate Pansy Tlakula, Chairperson of the Information Regulator of South Africa, we discussed the Information Regulator’s mandate, and the implementation of data protection legislation in South Africa.  Now, with less than a month to go before South Africa’s Protection of Personal Information Act, 2013 (“POPIA”) is set to go into full effect on July 1, 2021, it is critical for organizations operating in South Africa to ensure that they are ready if and when the Information Regulator comes knocking.

It is only when organizations start their POPIA journey that they realize just how wide the POPIA net is cast, and that very few businesses fall outside of its reach.  The road to POPIA compliance should be viewed as a marathon, and not a sprint.  While implementing and maintaining an effective POPIA compliance program will take continued effort and resources well beyond the July 1, 2021 go-live date, here we outline five steps to which companies subject to POPIA should give their attention in the short term.

Step 1: Identify and Appoint an Information Officer

POPIA provides for a similar position as the GDPR’s data protection officer in the form of an “Information Officer.” Organizations subject to POPIA must identify an Information Officer who will be responsible (and who may be held personally liable) for, among other things, all of the organization’s data protection compliance requirements, working with the Information Regulator, establishing policies and procedures, and POPIA awareness and compliance training.

The “head” of the organization (i.e., the CEO, managing director, or “equivalent officer”) is automatically deemed the organization’s Information Officer, however, the organization can “duly authorise” another person in the business (who is at management level or above) to act as Information Officer.  Similarly, the organization can designate one or more employees (also at management level or above) to act as “Deputy Information Officers” to assist the Information Officer perform his or her responsibilities.  Both the Information Officers and Deputy Information Officers must be registered with the Information Regulator before the end of June 2021, via the Information Regulator’s Online Registration Portal, or by submitting the downloadable Manual Registration Form to the Information Regulator.

Step 2: Review the Organization’s Marketing Practices

While many organizations may not consider themselves to be engaging in so-called “direct marketing” practices, this concept is widely defined in POPIA to include “any approach” to a data subject “for the direct or indirect purpose of […] promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject […].”  POPIA provides data subjects with certain rights with respect to unsolicited “electronic communications” (i.e., direct marketing by means of automatic calling machines, fax machines, SMSs, or emails).  The processing of a data subject’s personal information for the purposes of direct marketing is prohibited, unless the data subject has consented to the processing, or the email recipient is an existing customer of the organization.

In practical terms, the organization must have obtained the data subject’s details through the sale of a product or service, and the marketing should only relate to similar products or services of the organization.  The data subject must be given a reasonable opportunity to object to the use of their personal information for marketing each time the organization communicates with the data subject for marketing purposes, i.e., recipients must be able to “opt-out” at any stage.  Potential new customers can only be marketed with their express consent, i.e., on an “opt-in” basis.

Step 3: Review the Organization’s Security Measures Aimed at Protecting Personal Information, and Understand What Steps Must Be Taken in the Event of a Data Breach

POPIA obliges organizations to take appropriate technical and organizational measures to safeguard the security and confidentiality of personal information – aimed at preventing any loss, damage to, or unauthorized destruction of personal information, including measures to prevent unlawful access to, or processing of personal information under the organization’s control.

There is a general data breach notification obligation under POPIA.  Where there are reasonable grounds to believe that a data subject’s personal information has been accessed or acquired by an unauthorized person, the organization, or any third party processing personal information under its authority (e.g., an outsourced payroll service provider), must notify the Information Regulator and the data subject of the data breach “as soon as reasonably possible,” unless the identity of the data subject cannot be established.  It is therefore crucial that organizations ensure that they have an effective data security incident protocol in place, which will allow them to comply with the breach notification obligations under POPIA, and avoid falling under additional scrutiny.

Step 4: Review the Organization’s Existing Data Transfer and Outsourcing Arrangements

POPIA generally applies not only to organizations that process personal information in South Africa, but also to any person or company that processes personal information on behalf of the organization – commonly referred to as a “processor.”  POPIA also applies to organizations outside of South Africa that process personal information in South Africa with the assistance of a third party (e.g., a channel partner, or outsourced service provider).  Where any processing of personal information is outsourced by an organization, it must, in terms of a written contract between it and the processor, ensure that the party processing personal information on the organization’s behalf establishes and maintains appropriate security measures as prescribed under POPIA.

POPIA contains a general prohibition on cross-border transfers of personal information.  However, this prohibition is subject to numerous exceptions, including: (1) where the data subject consented to the transfer; (2) the transfer is necessary for the performance of a contract between the company and the data subject; (3) the transfer is necessary for the conclusion or performance of a contract between the company and a third party that is in the interest of the data subject; or (4) the transfer is for the benefit of the data subject.  Where personal information is being transferred to a third party outside of South Africa, the company must ensure that the recipient of the personal information is subject to a law, binding corporate rules, or binding contract which provide an adequate level of protection that effectively upholds POPIA’s principles for reasonable processing, and that include provisions substantially similar to the conditions for the lawful processing of personal information, and for the further transfer of personal information under POPIA.

Step 5: Deliver POPIA Awareness Training

POPIA awareness training is a not only a valuable tool for organizations to promote compliance, it is also a requirement under the POPIA Regulations.  The Information Officer must ensure that awareness sessions are conducted regarding the provisions of POPIA, the POPIA Regulations, codes of conduct (where applicable), as well as any information that is obtained from the Information Regulator from time to time.

*           *           *

If you have questions about handling data privacy compliance matters, please contact Dan Cooper at dcooper@cov.com, Ben Haley at bhaley@cov.com, Deon Govender at dgovender@cov.com, Ahmed Mokdad at amokdad@cov.com, Shivani Naidoo at snaidoo@cov.com, or Kgabo Mashalane at kmashalane@cov.com. This article is intended to provide general information. It does not constitute legal advice.

Photo of Deon Govender Deon Govender

Deon Govender is a vice chair of the Africa Practice Group. He focuses his practice on project development and corporate and project finance transactions across Africa, with particular emphasis on southern Africa. His experience ranges from advising on the development and financing of…

Deon Govender is a vice chair of the Africa Practice Group. He focuses his practice on project development and corporate and project finance transactions across Africa, with particular emphasis on southern Africa. His experience ranges from advising on the development and financing of renewable energy and thermal power projects and various other infrastructure assets in the transportation and telecommunications sectors. Deon’s experience additionally includes advising on financing independent power producer projects under the South African government’s Renewable Energy Independent Power Producer Procurement Programme.

Photo of Benjamin Haley Benjamin Haley

Ben Haley leads the firm’s White Collar and Anti-Corruption Practice in Africa and is a chair of the firm’s broader Africa Practice. With deep experience representing clients before regulators in high-profile white collar and disputes matters and a history operating on the…

Ben Haley leads the firm’s White Collar and Anti-Corruption Practice in Africa and is a chair of the firm’s broader Africa Practice. With deep experience representing clients before regulators in high-profile white collar and disputes matters and a history operating on the ground across the continent, he helps clients assess and mitigate complex legal and compliance risks in Africa and other emerging markets.

Complementing his investigations and dispute resolution practice, Ben has a broad-based compliance advisory practice, helping clients proactively manage compliance risk in areas including anti-corruption, anti-money laundering, fraud, and data privacy.

Ben represents corporate and individuals clients in a wide range of investigations and disputes, including:

  • Investigations under the U.S. Foreign Corrupt Practices Act (“FCPA”).
  • Investigations into anti-money laundering, financial crimes, anti-terrorism, and international trade controls issues.
  • Securities fraud and accounting matters.
  • Board investigations and shareholder litigation.
  • Insurance recovery.

Ben also regularly advises clients on a range of regulatory compliance and corporate governance issues. His compliance advisory practice includes:

  • Performing risk and compliance program assessments.
  • Leading compliance reviews on business partners and assisting companies with third-party risk management processes.
  • Conducting forensic accounting reviews and testing and enhancing financial controls.
  • Advising on market entry, cross-border transactions, and pre-acquisition diligence and post-acquisition integration.
  • Assisting companies in designing, implementing, and maintaining best-in-class compliance programs.

In recent years, Ben has steered a number of clients to successful resolutions and declinations in complex FCPA and corporate fraud matters with the U.S. Department of Justice and Securities Exchange Commission. In his advisory practice, Ben has served as lead compliance counsel on a number of major M&A transactions. He has developed special expertise assisting clients in leveraging technology in their compliance programs, including assisting one of the world’s largest consumer goods companies in the design and implementation of an award-winning compliance data analytics and monitoring system.

Ben has been described by the Chief Compliance Officer of one of his clients as “[a]n outstanding senior lawyer and advisor,” and “a guiding light for all things compliance advisory in Africa,” whose “advice is crystal clear, covers all angles and is business friendly.”

Photo of Ahmed Mokdad Ahmed Mokdad

Ahmed Mokdad is an associate in the firm’s compliance and investigations practice in Africa. As a seasoned investigative specialist with deep experience representing clients across various sectors, he regularly assists clients across the continent navigate and mitigate a broad spectrum of regulatory and…

Ahmed Mokdad is an associate in the firm’s compliance and investigations practice in Africa. As a seasoned investigative specialist with deep experience representing clients across various sectors, he regularly assists clients across the continent navigate and mitigate a broad spectrum of regulatory and compliance risks and challenges.

Adding to his on the ground investigative, regulatory and compliance advisory experience, Mr. Mokdad has also extensively advised on litigious matters and financial transactions. Mr. Mokdad has been involved in several high profile litigious matters and international arbitrations relating to, amongst others, tax disputes and exchange control violations, corporate and commercial disputes, public procurement and white collar crime. He regularly performs risk and compliance program assessments, third-party risk due diligence, advising on pre-acquisition diligence and post-acquisition integration.

Shivani Naidoo

Shivani is a South African qualified lawyer and associate in the firm’s Africa Practice Group. She advises on a broad range of general transactional matters including corporate governance, JSE listing requirements, and intellectual property. She has particular expertise in drafting and negotiating agreements…

Shivani is a South African qualified lawyer and associate in the firm’s Africa Practice Group. She advises on a broad range of general transactional matters including corporate governance, JSE listing requirements, and intellectual property. She has particular expertise in drafting and negotiating agreements in relation to acquisitions, joint ventures, trade agreements, licensing, franchising, supply chain, agency, distribution and logistics, outsourcing, broadcasting and licensing, privacy and data protection, and performer contracts. Her experience also includes conducting due diligence investigations related to corporate transactions.

Shivani has assisted both local and foreign clients in establishing companies in South Africa, as well as advising on various regulatory matters such as the South African Companies Act and the Broad-Based Black Economic Empowerment Act (“B-BBEE”). She has strong capabilities in structuring B-BBEE transactions, as well as drafting and negotiating related commercial documents in relation to share subscriptions, business and asset allocation, board and shareholder resolutions, trust deeds, memoranda of incorporation, waiver letters, empowerment transactions, assignment agreements, and TRP applications.

Shivani gained extensive experience and a working knowledge of the telecommunications industry while on secondment to Liquid Telecommunications South Africa Proprietary Limited. Her experience includes, among other capabilities, advising on general commercial matters pertaining to the business, drafting and negotiating various tender proposals, dark fiber asset sale agreements, and fiber maintenance agreements.

Photo of Dan Cooper Dan Cooper

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing…

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing clients in regulatory proceedings before privacy authorities in Europe and counseling them on their global compliance and government affairs strategies. Dan regularly lectures on the topic, and was instrumental in drafting the privacy standards applied in professional sport.

According to Chambers UK, his “level of expertise is second to none, but it’s also equally paired with a keen understanding of our business and direction.” It was noted that “he is very good at calibrating and helping to gauge risk.”

Dan is qualified to practice law in the United States, the United Kingdom, Ireland and Belgium. He has also been appointed to the advisory and expert boards of privacy NGOs and agencies, such as Privacy International and the European security agency, ENISA.