Découverte en profondeur
Discover all personal data and sensitive information of South Africa residents — wherever it is stored across the enterprise.
What Is the Purpose of POPIA?
South Africa’s Protection of Personal Information Act (POPIA) aims to give the citizens of South Africa more control over their data and require that organizations do more to protect the personal data they process.
Under the law — which became enforceable on July 1, 2021 — “processing” personal information includes collecting, receiving, recording, organizing, retrieving, using, disseminating, distributing, or making it available.
POPIA Règlements
Among other data privacy and protection measures, POPIA:
- gives South African data subjects nine actionable, enforceable rights over their personal information — including the rights to access, correction, and deletion
- requires that companies follow eight minimum requirements for data processing (e.g., requiring consent as a legal basis)
- creates a broad definition of personal
information - establishes the enforcement and supervisory body South African Information Regulator (SAIR), with broad powers to investigate and fine responsible parties
Who Does POPIA Apply To?
POPIA applies to any organization that:
- processes personal information in South Africa
- is domiciled in South Africa
- is not domiciled in South Africa but that
processes personal information in South Africa
Unlike GDPR, which requires compliance of any organization that processes personal data of data subjects within the EU, POPIA requires compliance of any organization that processes personal information within the country.
What Is Considered Personal Data Under POPIA?
POPIA defines personal information broadly, as “any information relating to not only a living person but also a company or legal entity.”
However, in a point of ambiguity that could lead to enforcement difficulties and possible abuses, POPIA also allows companies to process data if it’s deemed in the user’s “legitimate interest.”
Companies who are noncompliant with POPIA can face fines of up to 10 million ZAR — and even criminal penalties and prison time.
What Is the Difference Between GDPR and POPIA?
While POPIA is modeled after GDPR, there are some key differences between the South African and EU laws. They include:
- POPIA protects companies as “juristic persons,” while GDPR only protects individuals
- POPIA focuses on the location of processing rather than the location of the data subject (GDPR).
- POPIA requires companies to appoint an Information Officer and Deputy Information Officer, whose roles differ from the GDPR’s Data Protection Officer
- POPIA requires breach notification within a reasonable time period — and GDPR within 72 hours
- POPIA requires DSAR response within a reasonable time frame — and GDPR with a month at the most.
Solutions BigID for POPIA Compliance
Voyez-le en action
En savoir plus
Classification des données de nouvelle génération
La classification des données repensée pour le paysage des données moderne — pour toutes les données, partout.
Technologie de corrélation et de graphique
Automatically establish how identifiable data relates to a resident’s identity — and uncover data relationships.
Automatisation des droits sur les données
Automate end-to-end data rights, quickly locate all data kept on an individual, and manage subject access requests at scale.
Processus et partage des données
Gérez, surveillez et validez les activités de traitement et de partage des données dans l’ensemble de votre environnement de données.
Prix & Reconnaissance
Planifier une démonstration
Obtenez une démonstration personnalisée avec nos experts en données sur la confidentialité, la protection et la perspective - et voyez BigID en action.
Leadership dans l'industrie
