POPIA in software channel deals

The Protection of Personal Information Act 4 of 2013 (POPIA) protects personal information: information about an identifiable, living person and, where it applies, an identifiable, existing company or other organisation. The person the information is about is the data subject. A business that decides the purpose of and means for processing the information is the responsible party. A business that processes it for a responsible party under a contract or mandate (an instruction to act for it), without coming under its direct authority, is an operator.

Roles follow the facts. Having access to a customer’s data does not, on its own, make a business an operator. Ask for whom, and for what purpose, it handles each set of information. A partner that uses information for its own purposes, such as its own customer list and invoicing, is the responsible party for that information. So our agreements make each side answer to the other for processing lawfully, and keeping secure as section 19 of POPIA requires, the personal information it handles for itself. We choose each role from the facts of the deal: who decides, and for whom each business processes.

The table shows the usual roles under our agreements for end customers’ personal information. The general difference between a responsible party and an operator is explained in our guide to POPIA for tech companies.

If you are the vendor, tell us who will give support, who will host and who signs the customer contracts: those facts set the roles. If you are the partner, check that your customer contracts allow what the chain needs, such as using the vendor’s service to process your customers’ information.

Section 20 of POPIA says that an operator, or anyone processing personal information for a responsible party or an operator, may process it only with the knowledge or authorisation of the responsible party. It must also keep the information confidential. So a sub-operator needs the customer’s authority, not just the operator’s instruction.

Our agreements deal with that authority at the top of the chain. Under our reseller agreement you, the vendor, must make sure your end-user terms allow you to use the reseller as your sub-operator for first-line support. Where the partner is the operator, its own customer contract must allow it to engage you, and we confirm that clause only after reading the contract.

The VAR. Our value-added reseller (VAR) agreement records which roles apply, and a separate data processing agreement is signed for each one:

• You host and the VAR supports. You process each customer’s information under your terms for hosted software. The VAR, in giving support, is your sub-operator.
• The VAR hosts for its own clients. Each client is the responsible party and the VAR is its operator, under its own agreement with that client. If you process the clients’ information for the VAR, you are the VAR’s sub-operator.
• You support the VAR’s own systems, for example by remote access. For the VAR’s own information, the VAR is the responsible party and you are its operator.

How the hosted model works is on our VAR page.

If you are the vendor, list who supports, who hosts and whose terms each customer accepts. If you are the partner, check that your customer contracts allow you to use the vendor as a sub-operator before you go live.

Section 21(1) of POPIA requires the responsible party to ensure, by a written contract with its operator, that the operator establishes and maintains the security measures in section 19. Those are appropriate, reasonable technical and organisational measures against loss, damage, unauthorised destruction and unlawful access or processing.

Our channel agreements contain no operator terms of their own. Each one names a separate data processing agreement, which both sides sign before the processing starts. The business that will process may not begin until then. On the processing of personal information, the data processing agreement prevails over the channel agreement. Under our VAR agreement, one is signed for each role that applies.

In a chain, our data processing agreement covers the link between operator and sub-operator. On the link above it, the operator’s own contract with each customer is the written contract that section 21(1) requires.

No data processing agreement is used where the two businesses are each responsible parties for their own purposes, for example a referral partner passing you a prospect’s details. Treating such a partner as an operator would misdescribe the deal.

What a data processing agreement should contain in general is on our data processing agreements page.

If you are the vendor, have it signed before the partner logs in to any customer account. If you are the partner, read its incident, supplier and data-return terms as closely as the commercial terms.

Sections 23 and 24 of POPIA direct these requests to the responsible party. A person may ask it to confirm whether it holds their information and to give them a record or description of it. They may also ask it to correct or delete information that is, for example, inaccurate, out of date or obtained unlawfully. In most channel deals the responsible party is the end customer.

A request can still reach the wrong business. An employee of your customer may email the reseller’s help desk, or your own support team, asking to see or delete their records. Our data processing agreement covers that case. The business lower in the chain does not answer the request itself, unless a law requires it to. It acknowledges the request, refers the person to the business it works for, and passes the request on within 5 business days. It then gives reasonable help, including through the software’s own functions, so that the request can be answered in time. Help beyond what the software already does can be charged at fees agreed in advance. The operator’s own contract with each customer covers the top link.

Each business still answers requests about information it holds for its own purposes, such as its own customer list.

The rights themselves are explained on our data subject rights page. Whichever side you are on, tell your support staff how to recognise such a request and where to send it.

What the law says. Section 21(2) of POPIA requires an operator to notify the responsible party immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. Section 22 then requires the responsible party to notify the Information Regulator and the affected people, unless their identity cannot be established. It must do so as soon as reasonably possible after discovering the compromise. That allows for the needs of law enforcement and the steps needed to find the scope of the compromise and restore its systems. POPIA sets no number of hours.

What our agreements add. Each extra link in a chain costs time. So where a vendor or partner is a sub-operator, our agreements require it to report to the business above it immediately, and within 24 hours in any case. So the 24 hours does not replace “immediately”. It is a period the parties agree for the extra link, not a legal deadline.

• White-label: the provider reports to the partner, and the partner to each affected customer, within 24 hours on each link.
• SaaS distribution: the vendor reports to the distributor within 24 hours. The distributor sets a period for telling its customers that lets them meet their own duties.
• Reseller, VAR and an OEM that hosts: the sub-operator reports within 24 hours.

Under our OEM and referral partner agreements, where there is no chain, the period is set per deal and can be longer, as the table above shows. Notice is still due immediately; the hours are an outer limit.

Who speaks. Section 22 puts the duty to notify the Information Regulator and the affected people on the responsible party. That is why each business lower in the chain must report upward quickly: the customer cannot give its notices until it knows. Under our data processing agreement, a business lower in the chain may not notify the Information Regulator or the affected people itself without the written approval of the business above it, unless a law requires it. It must tell the business above it what it knows, such as what happened, whose information was affected and what it has done, and help with the customer’s own notices.

The general rules on breach notices are on our data breaches page. If you are the vendor, make sure your monitoring lets you report within 24 hours. If you are the partner, make sure your customer contracts give your customers notice fast enough for them to meet section 22.

Section 72(1) of POPIA stops a responsible party in South Africa from transferring personal information to a third party in a foreign country unless one of five grounds applies:

• The recipient is bound by a law, binding corporate rules or a binding agreement that gives adequate protection. That protection must include limits on sending the information on to another country.
• The person the information is about consents.
• The transfer is needed to perform a contract with that person, or steps they asked for before one.
• The transfer is needed for a contract made in that person’s interest with someone else.
• The transfer benefits the person, getting their consent is not reasonably practicable, and they would be likely to give it.

Our agreements start from the first ground. Where a channel deal involves processing abroad, each side may transfer personal information it received from the other to someone in a foreign country only if the recipient is bound by terms that require it to process the information on principles substantially similar to POPIA’s conditions. Those terms must include a limit on transferring it further.

Our data processing agreement adds conditions for transfers abroad by a sub-operator and its own suppliers, such as a cloud host:

• The recipient abroad must be bound in writing to POPIA-like principles, security no weaker than section 19 requires, immediate notice of a breach and limits on sending the information further.
• The sub-operator may not rely on its own view that another country’s law protects the information well enough. It may rely on another of the five grounds only if the business it works for confirms that ground in writing.
• Remote access to the information from another country, for example a support engineer logging in from abroad, counts as a transfer.

Special personal information and children’s information. Special personal information includes information about a person’s health, religion, race or biometrics. Sending it, or children’s information, to a country without an adequate level of protection needs the Information Regulator’s authorisation first (section 57(1)(d)). Our data processing agreement does not allow either kind to be given to the business processing for another unless the agreement expressly allows it.

The general rules are on our cross-border transfers page. If you are the vendor, keep a list of where you and your own suppliers host and support from. If you are the partner, ask for that list before you promise customers anything about where their data sits.

Section 69(1) of POPIA prohibits processing personal information for direct marketing by any form of electronic communication, such as email or SMS. The exceptions are a person who has consented, and an existing customer of the business doing the marketing. A lead a referral partner sends you is usually not yet your customer.

Our referral partner agreement deals with this directly. Each referral must state the means by which the prospect agreed to be contacted by you. The partner promises that it collected the details lawfully and that the prospect agreed to be contacted by that means. The agreement also limits how the details may be used, and covers objections and evidence of the consent.

The prospect’s details pass between two separate responsible parties, so no data processing agreement is needed. One is needed only if the partner processes personal information for you, for example by running a joint sales campaign. You are then the responsible party and the partner your operator. A referral partner is never a sub-operator.

The general rules, including the single request for consent, are on our electronic marketing page. The agreement itself is on our referral partner agreements page.

If you are the vendor, keep each referral’s consent record with the lead. If you are the partner, pass on only leads who agreed to hear from the vendor, and say how they agreed.