Protection of Personal Information Act, 2013 (Act 4 of 2013)

Why is the Protection of Personal Information Act, 2013 essential?

It is an important legislation in South Africa that aims to protect the privacy and personal information of individuals.

Here’s why POPIA is essential:

• Enhanced Consumer Protection: POPI Act strengthens consumer protection by establishing clear rights for individuals regarding their personal information. It provides individuals with greater control and knowledge about how their data is processed, ensuring transparency and accountability from organizations.
• Data Privacy Rights: POPI Act empowers individuals with the right to know what happens with their personal data. It promotes data transparency, allowing individuals to understand and control their digital footprint. This helps individuals make informed decisions about the collection, use, and sharing of their personal information.
• Preventing Unauthorized Data Sales: One of the key objectives of the POPI Act is to prevent the unauthorized sale of personal information. By requiring organizations to obtain explicit consent from individuals for the processing and sharing of their data, POPIA helps individuals protect their personal information from being sold or misused without their knowledge or consent.
• Non-Discrimination: POPI Act includes provisions that prohibit discrimination against individuals who exercise their rights under the Act. This means that individuals who choose to exercise their privacy rights cannot be denied services, charged different prices, or treated unfairly based on their choices.
• Accountability and Compliance: POPI Act places responsibilities on organizations to handle personal information responsibly and implement appropriate security measures. This promotes a culture of data protection and accountability, ensuring that organizations are held accountable for the way they collect, use, and safeguard personal information.

Who and what falls under the purview of the Protection of Personal Information Act, 2013?

Under the Protection of Personal Information Act, 2013 (Act 4 of 2013) (‘POPIA’), the scope and applicability extend to various entities and types of information.

• Individuals Covered: POPIA applies to all individuals whose personal information is being processed by public or private entities in South Africa. This includes citizens, residents, and visitors within the jurisdiction.
• Personal Information: POPIA defines personal information as any information relating to an identifiable, living individual. It encompasses a broad range of data, including but not limited to names, contact details, identification numbers, financial information, employment history, biometric information, and online identifiers.
• Public and Private Entities: POPIA applies to both public and private organizations involved in the processing of personal information. This includes government agencies, businesses, non-profit organizations, and other entities that collect, use, store or share personal data.
• Processing Activities: POPIA covers various processing activities, such as the collection, storage, use, dissemination, and destruction of personal information. It applies to both manual and automated processing methods.
• Reasonable Security Practices: POPIA mandates that organizations implementing measures to protect personal information must maintain reasonable security practices and procedures to prevent unauthorized access, loss, destruction, alteration, or disclosure of personal data.
• Compliance Obligations: Entities subject to POPIA have certain obligations, including obtaining consent for processing personal information, providing individuals with access to their data, ensuring accuracy and accountability of information, and notifying individuals and regulators in the event of data breaches.
• Information Regulator: POPIA establishes an Information Regulator, an independent regulatory body responsible for monitoring and enforcing compliance with the Act. The Information Regulator has powers to investigate complaints, issue fines, and provide guidance on matters related to personal information protection.

How is BizProspex compliant with the POPIA regulations?

BizProspex, being the leading services provider in the business, understands the requirements and responsibilities of delivering legitimate and accurate data. We stand out as global leaders when it comes to CRM cleaning, Data appending, Data mining, Tech install, Data Merging, and Data Deduping for B2B clients. We aim at supplying our clients with public data scraping of the highest quality to boost your sales numbers. At BizProspex, we focus on becoming the partner your organization needs to survive, and in the long run, thrive.

By understanding what your company’s needs are, we’re prepared to bring you solutions with legitimacy that truly make a difference. We are one of the Best Legally Compliant Data Service Providers around the world and we are known for our capabilities to make complex things easy for business people and help them understand the key needs. 

Here are some key steps that BizProspex undertakes to ensure compliance with POPIA:

• Data Assessment: Conduct a comprehensive assessment of the information scraped, used, and shared by the business. Identify the types of information, the purposes of processing, and any third parties with whom it is shared.
• Privacy Policies and Notices: Review and update the company’s privacy policies and notices to align with POPIA requirements. Clearly communicate to individuals the types of data collected, the purposes of processing, and their rights regarding their data.
• Consent: Obtain explicit and informed consent from individuals before collecting and processing publicly scraped data. Ensure that the purpose of data collection and processing is clearly explained and that clients have the option to withdraw their consent.
• Data Subject Rights: Implement mechanisms to handle data subject rights requests, such as access, correction, and deletion of personal information. Establish processes to verify the identity of data subjects making such requests.
• Data Security: Implement appropriate technical and organizational measures to safeguard scraped information against unauthorized access, disclosure, or loss. This includes encryption, access controls, regular security assessments, and employee training on data security practices.
• Data Breach Response: Develop and implement a data breach response plan to detect, assess, and respond to data breaches. Establish procedures for notifying affected individuals and the relevant regulatory authorities in the event of a breach.
• Employee Training: Train employees on POPIA requirements, including data protection principles and their responsibilities in the prevention of handling any PII  information. Promote a culture of privacy and data protection throughout the organization.
• Vendor Management: Review and update agreements with third-party vendors (located or dealing from South Africa) to ensure they comply with POPIA and related requirements when processing scraped public information on behalf of the business. Conducting due diligence on vendors’ data protection practices.

Our privacy policies (that are mentioned on the website) clearly state how the data for processing is collected, how it is processed, and who in our team can be contacted regarding data storage and processing. As a POPIA-compliant enterprise, it’s our responsibility to ensure that:

• Informing people of a data breach.
• Absolutely honoring requests that personal information not be sold.
• Avoiding discrimination against individuals who exercise POPIA rights.

We claim the highest standards of work ethics with utmost obedience to laws that we are subject to. All the pre-scraped public data that we collect and the process is done so with the contractual consent of our customers under the purview of the POPIA guidelines. At BizProspex our compliance and audit experts work tirelessly to make sure all the right compliance controls are in place when it comes to data.

Disclaimer: The information on this page is being provided for information purposes regarding the operations of BizProspex within the legal ambit. Information contained on or made available herein is not intended to and does not constitute legal advice, recommendations, mediation, or counseling under any circumstance. The use thereof does not create any attorney-client relationship. Do not act or rely on any information provided herein without seeking the advice of attorney licensed to practice for your particular business.