Legal updates and opinions
News / News
Business must protect the data of all South Africans
If your business has met all the requirements of European data privacy regulations, do you then also comply with South Africa’s Protection of Personal Information Act (POPIA)?
Not necessarily.
Although the General Data Protection Regulation (GDPR) and POPIA share many similar requirements, there are some differences.
The GDPR applies to companies in the European Union (EU), as well as organisations outside the EU that offer goods or services or process personal data of EU citizens. POPIA promotes the constitutional right to privacy of South African individuals and companies by safeguarding the personal information of natural persons and identifiable juristic persons.
Many South African companies with cross-border operations have to be GDPR compliant.
But these companies need to consider the particular nuances of South African society when complying with local data privacy legislation. The main consideration is whether the way in which you are processing personal information is in line with public interest.
So what should companies do?
First and most important, companies need to clearly understand their customers. Think about education levels, literacy, access to technology and geographical location, among others.
Armed with a deep understanding of their customers, companies must then communicate about the use of personal information in a way that is easily understandable to their audience.
The onus to communicate clearly to customers will be higher when complying with POPIA than GDPR given the differences in education levels and sophistication of South African consumers compared to Europeans. South Africa is not only one of the most unequal countries in the world, its education levels also vary considerably across the population. Also, consider that the average person in the European Union is expected to undertake 17.6 years of education over their lifetime (Statista.com). In South Africa the average is 13,5 years (UN Development Programme).
South African companies need to put a lot of thought into making sure they really understand their customers. They need to use plain language in their communications. Should they wish to rely on consent when processing personal information, they will be required to demonstrate that they obtained proper informed consent from a customer. That customer must fully understand that their personal information is being collected and processed and for what purpose. Everyone in society has the exact same right to the privacy of information. Companies need to start thinking about whether their data protection processes cater for the nuances of South African society.
Latest News
Revisiting Zero-Tolerance Policies: The NBCCI’s Ruling on Cannabis Use
and Hanán Jeppie - Candidate Attorney ISSUE In National Union of Metalworkers of South Africa obo Nyawuza / PFG Building [...]
Whether a workplace policy automatically forms part of or can otherwise be construed as a collective agreement
and Tasreeq Ferreria - Candidate Attorney Issue Whether the Commission for Conciliation Mediation and Arbitration (the "CCMA") was correct in [...]
The South African Reserve Bank tightens “instant payment” framework in South Africa – screen scrapers beware!
Following the COVID-19 pandemic, more people than ever are ordering goods online based on the variety of good and services [...]
FIC publishes Directive 9 to ensure CASPs comply with FATF Recommendations
- reviewer and authored by Slade van Rooyen - Candidate Attorney The Financial Intelligence Centre ("FIC") on 15 November 2024 [...]
It is not only diamonds that are forever – a snapshot of forever and hazardous chemicals
A recent study conducted by the Manchester Metropolitan University revealed that the processes intended to decontaminate noxious liquid landfill waste [...]
Machine managers: AI monitoring in the South African workplace
The impact of AI on the workplace is a rapidly evolving field of study, and South Africa can look to [...]