The Protection of Personal Information Act 4 of 2013 ("POPI") was published on the 26th of November 2013 with only limited sections currently in effect. Once fully effected, POPI will have a significant impact on those persons or juristic entities processing personal information. Processing has a far reaching definition and personal information can only be processed if the following circumstances exist:
the consumer has consented to the processing; or
the processing is necessary to carry out actions for the conclusion or performance of a contract to which the consumer is a party; or
processing complies with an obligation imposed by law on the responsible party; or
processing protects a legitimate interest of the consumer; or
processing is necessary for the proper performance of a public law duty by a public body; or
processing is necessary for pursuing the legitimate interest of the responsible party or of a third party to whom the information is supplied.
As a general rule, where consent has been obtained the personal information can be processed and in the event that the consumer withdraws his/her consent, the personal information cannot be processed and must be destroyed or de-identified. There are however certain instances which POPI and other legislation permit, where consent is not required for processing. For example, the prevention of fraud.
For more information please do not hesitate to email us.