Legal updates and opinions
Post Author
News / News
ARE YOUR CONTRACTS WITH SUPPLIERS / CONTRACTORS SUFFICIENT TO ENSURE COMPLIANCE WITH POPIA?
By Tebogo Sibidla, Director and Kirsten Whitworth, Senior Associate
In anticipation of the coming into operation of the Protection of Personal Information Act, 2013 (“POPIA”), many companies are making changes to various business processes, systems and documents. Key documents under review include contracts with suppliers, contractors or other persons who process personal information on behalf of these companies (“operators”).
Here is a handy checklist of key contractual components that you can use to ensure that your contracts with operators are POPIA compliant and to reduce your risks when outsourcing the processing of personal information to third parties.
| 1. | Reduce the contract to writing and have it signed by all parties. | |
| 2. | Define key terms and concepts in detail, e.g. “personal information”, “special personal information”. | |
| 3. | Clearly identify what personal information the operator is authorized to process, how they can access it, the purpose for their processing it, what the operator may or may not do with it and how long the processor may retain it . | |
| 4. | Require that the operator ensures that personal information is complete, accurate and up to date, and not misleading. | |
| 5. | Require that the operator undertake to process personal information only with your express written knowledge or permission, to treat all personal information as confidential and not disclose it unless required by law or authorized by you. | |
| 6. | Require that the operator undertake to only process personal information in accordance with the contract and to comply with POPIA. | |
| 7. | Require that the operator ensure that each of its employees, agents, representatives is aware of the operators requirements under POPIA and the contract, and have committed themselves to keeping personal information confidential. | |
| 8. | State clearly what specific technical, administrative and physical security measures the operator must put in place to protect the personal information from loss or damage, or unauthorized access, processing or destruction, including by when these measures must be in place. | |
| 9. | State clearly how often the operator must assess, review and update the security measures, and the process the operator must follow before making changes to the agreed security measures. | |
| 10. | Give yourself the right to audit the operator’s security measures, assess and verify that the processing is done in accordance with POPIA and your contract. | |
| 11. | Prevent the operator from outsourcing processing of personal information to third parties without your written permission. | |
| 12. | If the operator does outsource the processing of personal information, require that they sign a contract with the third party processer that contains similar requirements on processing of personal information. | |
| 13. | Require that the operator notify you immediately if it suspects or believes that personal information has been accessed or acquired by unauthorized persons or used in a manner inconsistent with the contract or POPIA, identifying the contact person and details that the operator must use to notify you. | |
| 14. | Hold the operator liable for any claims against you as a result of their breach of POPIA or the contract. | |
| 15. | Require that the operator assist you to respond to any queries or requests for access to personal information, and/or requests for the correction, destruction or deletion of personal information. | |
| 16. | Require that the operator, free of charge, return, delete or destroy personal information in their possession if the contract is cancelled or terminated for whatever reason, and clearly indicate by when operator must do this. |
Latest News
Understanding the 1 May 2026 BCEA Earnings Threshold Adjustment: Implications for employers and employees
by Banky Sono, Director, Dakalo Singo, Head of Pro Bono, Neo Sewela, Director and Sandile Mogweng, Candidate Attorney The Minister [...]
The Banks Win on Appeal: SCA Overturns R704 Million High Court Judgment
by Tshegofatso Matlou, Associate, reviewed by Jones Antunes, Director In the decision of African Banking Corporation of Zambia Limited and [...]
Out with the Old: South Africa’s Proposed Overhaul of Exchange Controls and the Inclusion of Crypto Assets
by Janice Geel, Associate and Azraa Sidat, Candidate Attorney, reviewed by Natalie Scott, Director and Head of Sustainability On 17 [...]
Do not call me I’ll call you …… South Africa’s 2026 CPA Amendment Regulations: operationalising the national opt‑out regime for direct marketing and shifting day‑to‑day anti‑spam responsibility to the National Consumer Commission
by Ahmore Burger-Smidt, Director and Head of Regulatory The Consumer Protection Act Amendment Regulations, 2026 deliver the long‑awaited operational framework [...]
Business Rescue Applications Under Scrutiny: business rescue orders are not there for the taking!
by Eric Levenstein, Director and Head Insolvency & Business Rescue and Amy Mackechnie, Senior Associate This article considers the recent decision in [...]
The AI Arms Race and what it means for Competition Law: A new era or new focus
by Ahmore Burger-Smidt, Director and Head of Regulatory We are not in the habit of writing breathless technology briefings. That [...]
