Who is an operator?
“’operator’ means a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party;”
Your payroll bureau, bulk-SMS and email platforms, cloud and hosting providers, IT support with admin access, the debt-collection agency on mandate, the managing agent, the shredding company — operators all. Your own employees are not (they act under your direct authority); a provider deciding its own purposes for the data is not an operator but a responsible party in its own right, which changes the analysis entirely.
The written-contract duty
Section 20 requires the operator to process only with your knowledge or authorisation and to keep the information confidential. The contracting duty, though, sits on you:
“A responsible party must, in terms of a written contract between the responsible party and the operator, ensure that the operator which processes personal information for the responsible party establishes and maintains the security measures referred to in section 19.”
And section 21(2): the operator “must notify the responsible party immediately where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person.” Immediately — because your section 22 clock starts running on discovery, and you cannot notify what your provider sat on. A practical starting point is the firm’s free POPIA operator agreement template.
The Dis-Chem lesson
This is not paperwork for its own sake. When Dis-Chem’s e-statement service provider, Grapevine, was brute-forced in 2022 — roughly 3.6 million data subjects’ records — the Regulator’s enforcement notice turned heavily on the fact that Dis-Chem had failed to “enter into an operator agreement with Grapevine and ensure that Grapevine has adequate security measures in place to secure personal information in its possession.” Dis-Chem complied with the notice and the file closed without a fine — but the finding stands as the canonical statement of the rule: the breach was the provider’s; the accountability was the client’s. Full details on the enforcement tracker.
Your operator inventory
- List every provider that touches personal information for you — payroll, IT, cloud, marketing platforms, collections, destruction
- Check each for a written contract covering s 19 security and s 21(2) immediate breach notification
- For global SaaS, locate the data-processing agreement in the terms and file it — that is your s 21 evidence
- Flag foreign processing for a s 72 gateway (the DPA usually is the binding agreement)
- Re-verify annually and whenever a provider changes hands or platforms