What is Popia?

The purpose of the Protection of Personal Information Act is to:

• Give effect to the constitutional right of privacy, in particular the safeguarding of personal information subject to justifiable limitations aimed at balancing the right of privacy against other rights, particularly that of access to information protecting the free flow of information.
• Regulate the processing of personal information in harmony with international standards.
• Prescribe minimum requirements for the lawful processing of personal information.
• Provide rights and remedies to protect against abuses of personal information.
• Establish a Regulator to promote, enforce and fulfil the rights protected by the Act.

The terms ‘personal information’ and ‘processing’ are accordingly central to the Act. The term ‘personal information’ means information relating to a person and includes all information about that person, including their characteristics and identifying information and correspondence that are implicitly or explicitly of a private or confidential nature. ‘Processing’ is similarly broad referring to any operational activity concerning personal information including the collection, organisation, storage, modification, communication, and destruction of information.

The Act provides stringent sanctions for non-compliance including civil damages, fines and imprisonment. Non-compliance is also likely to result in significant reputational harm to the responsible business.