If your business has met all the requirements of European data privacy regulations, do you then also comply with South Africa’s Protection of Personal Information Act (POPIA)?

Not necessarily.

Although the General Data Protection Regulation (GDPR) and POPIA share many similar requirements, there are some differences.

The GDPR applies to companies in the European Union (EU), as well as organisations outside the EU that offer goods or services or process personal data of EU citizens. POPIA promotes the constitutional right to privacy of South African individuals and companies by safeguarding the personal information of natural persons and identifiable juristic persons.

Many South African companies with cross-border operations have to be GDPR compliant.

But these companies need to consider the particular nuances of South African society when complying with local data privacy legislation. The main consideration is whether the way in which you are processing personal information is in line with public interest.

So what should companies do?

First and most important, companies need to clearly understand their customers. Think about education levels, literacy, access to technology and geographical location, among others.

Armed with a deep understanding of their customers, companies must then communicate about the use of personal information in a way that is easily understandable to their audience.

The onus to communicate clearly to customers will be higher when complying with POPIA than GDPR given the differences in education levels and sophistication of South African consumers compared to Europeans. South Africa is not only one of the most unequal countries in the world, its education levels also vary considerably across the population. Also, consider that the average person in the European Union is expected to undertake 17.6 years of education over their lifetime (Statista.com). In South Africa the average is 13,5 years (UN Development Programme).

South African companies need to put a lot of thought into making sure they really understand their customers. They need to use plain language in their communications. Should they wish to rely on consent when processing personal information, they will be required to demonstrate that they obtained proper informed consent from a customer. That customer must fully understand that their personal information is being collected and processed and for what purpose. Everyone in society has the exact same right to the privacy of information. Companies need to start thinking about whether their data protection processes cater for the nuances of South African society.