Legal updates and opinions
News / News
Business must protect the data of all South Africans
If your business has met all the requirements of European data privacy regulations, do you then also comply with South Africa’s Protection of Personal Information Act (POPIA)?
Not necessarily.
Although the General Data Protection Regulation (GDPR) and POPIA share many similar requirements, there are some differences.
The GDPR applies to companies in the European Union (EU), as well as organisations outside the EU that offer goods or services or process personal data of EU citizens. POPIA promotes the constitutional right to privacy of South African individuals and companies by safeguarding the personal information of natural persons and identifiable juristic persons.
Many South African companies with cross-border operations have to be GDPR compliant.
But these companies need to consider the particular nuances of South African society when complying with local data privacy legislation. The main consideration is whether the way in which you are processing personal information is in line with public interest.
So what should companies do?
First and most important, companies need to clearly understand their customers. Think about education levels, literacy, access to technology and geographical location, among others.
Armed with a deep understanding of their customers, companies must then communicate about the use of personal information in a way that is easily understandable to their audience.
The onus to communicate clearly to customers will be higher when complying with POPIA than GDPR given the differences in education levels and sophistication of South African consumers compared to Europeans. South Africa is not only one of the most unequal countries in the world, its education levels also vary considerably across the population. Also, consider that the average person in the European Union is expected to undertake 17.6 years of education over their lifetime (Statista.com). In South Africa the average is 13,5 years (UN Development Programme).
South African companies need to put a lot of thought into making sure they really understand their customers. They need to use plain language in their communications. Should they wish to rely on consent when processing personal information, they will be required to demonstrate that they obtained proper informed consent from a customer. That customer must fully understand that their personal information is being collected and processed and for what purpose. Everyone in society has the exact same right to the privacy of information. Companies need to start thinking about whether their data protection processes cater for the nuances of South African society.
Latest News
Employment Equity Amendment Act Commencement – Important news for employers employing more than 50 employees
The President of the Republic of South Africa has recently proclaimed that the Employment Equity Amendment Act No.4 of 2022 [...]
Shell shock: reversal of landmark Dutch ruling holds lessons for South African climate change litigation
- Reviewer and Slade van Rooyen - Candidate Attorney The 2021 decision of a Dutch district court in Milieudefensie v [...]
A step closer to establishing the National Council on gender-based violence and femicide
After the President assented to the National Council on Gender-Based Violence and Femicide Act No. 9 of 2024 ("Act") in [...]
The Climate Change Act has a crucial role to play in the fight against the climate crisis in South Africa
and Mmatshepo Papo - Candidate Attorney Frequent and intense weather events and devastating effects of climate change are being experienced [...]
Working From Home: Can Employers Withhold Pay Over Office Attendance?
and Hanán Jeppie - Candidate Attorney ISSUE In National Union of Public Service and Allied Workers obo Cesiko / South [...]
Revisiting Zero-Tolerance Policies: The NBCCI’s Ruling on Cannabis Use
and Hanán Jeppie - Candidate Attorney ISSUE In National Union of Metalworkers of South Africa obo Nyawuza / PFG Building [...]