Descubrimiento en profundidad
Discover all personal data and sensitive information of South Africa residents — wherever it is stored across the enterprise.
What Is the Purpose of POPIA?
South Africa’s Protection of Personal Information Act (POPIA) aims to give the citizens of South Africa more control over their data and require that organizations do more to protect the personal data they process.
Under the law — which became enforceable on July 1, 2021 — “processing” personal information includes collecting, receiving, recording, organizing, retrieving, using, disseminating, distributing, or making it available.
POPIA Normativa
Among other data privacy and protection measures, POPIA:
- gives South African data subjects nine actionable, enforceable rights over their personal information — including the rights to access, correction, and deletion
- requires that companies follow eight minimum requirements for data processing (e.g., requiring consent as a legal basis)
- creates a broad definition of personal
information - establishes the enforcement and supervisory body South African Information Regulator (SAIR), with broad powers to investigate and fine responsible parties
Who Does POPIA Apply To?
POPIA applies to any organization that:
- processes personal information in South Africa
- is domiciled in South Africa
- is not domiciled in South Africa but that
processes personal information in South Africa
Unlike GDPR, which requires compliance of any organization that processes personal data of interesados within the EU, POPIA requires compliance of any organization that processes personal information within the country.
What Is Considered Personal Data Under POPIA?
POPIA defines personal information broadly, as “any information relating to not only a living person but also a company or legal entity.”
However, in a point of ambiguity that could lead to enforcement difficulties and possible abuses, POPIA also allows companies to process data if it’s deemed in the user’s “legitimate interest.”
Companies who are noncompliant with POPIA can face fines of up to 10 million ZAR — and even criminal penalties and prison time.
What Is the Difference Between GDPR and POPIA?
While POPIA is modeled after GDPR, there are some key differences between the South African and EU laws. They include:
- POPIA protects companies as “juristic persons,” while GDPR only protects individuals
- POPIA focuses on the location of processing rather than the location of the data subject (GDPR).
- POPIA requires companies to appoint an Information Officer and Deputy Information Officer, whose roles differ from the GDPR’s Data Protection Officer
- POPIA requires breach notification within a reasonable time period — and GDPR within 72 hours
- POPIA requires DSAR response within a reasonable time frame — and GDPR with a month at the most.
Soluciones BigID for POPIA Compliance
Véalo en acción
Más información
Clasificación de datos de próxima generación
Data classification re-imagined for the modern data landscape — for all data, everywhere.
Tecnología de correlación y gráficos
Automatically establish how identifiable data relates to a resident’s identity — and uncover data relationships.
Automatización de derechos de datos
Automate end-to-end data rights, quickly locate all data kept on an individual, and manage subject access requests at scale.
Procesos y compartición de datos
Gestione, supervise y valide las actividades de procesamiento y uso compartido de datos en todo su entorno de datos.
Premios Reconocimiento
Programe una demostración
Obtenga una demostración personalizada con nuestros expertos en privacidad, protección y perspectiva de datos, y vea BigID en acción.
Liderazgo en el sector
