mjkinc.co.za

The Protection of Personal Information Act 4 of 2013 (POPIA) is South Africa's comprehensive data protection legislation, and it has particular significance for technology companies. By their very nature, tech companies collect, process, store, and transmit vast quantities of personal information -- from user account details and behavioural analytics to payment data and biometric identifiers. POPIA imposes legally binding obligations on how this data is handled, and the consequences of non-compliance are severe. For a broader perspective on technology law topics, see our Software & Technology Law hub.

Unlike industries where personal information processing is incidental to the core business, technology companies often exist precisely to process data. SaaS platforms, mobile applications, fintech services, healthtech solutions, e-commerce platforms, and data analytics providers all depend on the collection and processing of personal information as a fundamental aspect of their operations. This places technology companies squarely within POPIA's regulatory crosshairs and demands a more sophisticated approach to compliance than businesses in traditional sectors.

Responsible Party vs Operator -- The Critical Distinction

POPIA establishes two primary categories of entities that process personal information: the "responsible party" and the "operator." Understanding this distinction is essential for technology companies because it determines the nature and extent of their legal obligations.

The Responsible Party (Section 1)

A responsible party is the entity that determines the purpose and means of processing personal information. In technology terms, this is the entity that decides why data is collected and how it will be used. The responsible party bears the primary obligations under POPIA, including:

Ensuring that processing is lawful and complies with the eight conditions for lawful processing set out in Chapter 3 of POPIA
Notifying data subjects of the collection and use of their personal information (section 18)
Appointing an Information Officer and registering with the Information Regulator
Notifying the Information Regulator and affected data subjects of security compromises (section 22)

The Operator (Section 1)

An operator is a person or entity that processes personal information on behalf of, and under the authority or instruction of, the responsible party. In technology terms, this is a service provider that handles data according to its client's instructions. Cloud hosting providers, SaaS platforms processing client data, payment processors, and email delivery services typically act as operators. The operator's obligations are more limited but critically important:

Processing personal information only with the knowledge or authorisation of the responsible party
Treating all personal information as confidential and not disclosing it without proper authorisation
Establishing and maintaining appropriate security measures as required by section 19

Many technology companies are simultaneously responsible parties and operators. A SaaS company, for example, is a responsible party in relation to its own employees' personal information and its direct customers' account data, but acts as an operator when processing its customers' end-user data. This dual role requires a nuanced approach to compliance, with different policies and procedures for each capacity. The distinction also has significant liability implications: a responsible party may be held liable for the actions of its operator, making the selection and contractual management of operators a critical governance function.

Mandatory Operator Agreements

Section 21 of POPIA imposes a mandatory requirement on responsible parties to enter into a written contract with any operator that processes personal information on their behalf. This is not optional -- it is a legal prerequisite for the lawful engagement of any third-party data processor. For technology companies, this requirement has far-reaching implications for how services are contracted, delivered, and managed.

Required Elements of an Operator Agreement

Scope of processing: The agreement must clearly define what personal information will be processed, the purpose of the processing, and the specific processing activities the operator is authorised to perform.
Security measures: The operator must commit to establishing and maintaining security measures that meet or exceed the standards required by section 19 of POPIA, including technical measures (encryption, access controls, intrusion detection) and organisational measures (staff training, access policies, incident response plans).
Notification obligations: The operator must notify the responsible party immediately if there are reasonable grounds to believe that a security compromise has occurred. This is critical because the obligation to notify the Information Regulator and data subjects falls on the responsible party, not the operator.
Data return and deletion: Upon termination of the processing agreement, the operator must return all personal information to the responsible party or destroy it, subject to any legal retention requirements.
Sub-processing restrictions: The agreement should specify whether the operator is permitted to engage sub-operators, and if so, require prior written consent and impose equivalent obligations on any sub-operator through a back-to-back agreement.
Audit rights: The responsible party should retain the right to audit the operator's compliance with the agreement and with POPIA, either directly or through an independent third-party auditor.

Technology companies that provide services to other businesses -- whether as SaaS providers, cloud hosting companies, or managed service providers -- should have a standard operator agreement template ready for their clients. Conversely, technology companies that engage third-party services (cloud infrastructure, analytics tools, payment gateways) must ensure that operator agreements are in place with each of these service providers. The absence of a written operator agreement is itself a contravention of POPIA, regardless of whether any data breach has occurred. For more on how these obligations intersect with cloud service contracts, see our guide on SaaS agreements in South Africa.

Data Breach Notification

Section 22 of POPIA establishes a mandatory data breach notification regime. When there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and the affected data subjects. For technology companies, where data breaches can affect millions of records simultaneously, the stakes are particularly high.

Notification Requirements

Timing: Notification must be made "as soon as reasonably possible" after the discovery of the breach. The Information Regulator has indicated that this should occur within 72 hours of becoming aware of the breach, aligning with international best practice and the GDPR standard. Unjustified delays in notification may themselves constitute a contravention of POPIA.
Content of notification: The notification must include a description of the possible consequences of the breach, a description of the measures taken or proposed to be taken to address the breach, a recommendation regarding measures the data subject can take to mitigate the possible adverse effects, and (if known) the identity of the unauthorised person who may have accessed the information.
How to report: Breach notifications must be submitted to the Information Regulator through its official eServices portal. The portal allows responsible parties to submit security compromise notifications electronically, track the status of their submissions, and respond to any queries from the Regulator. Technology companies should familiarise themselves with this portal and test the submission process before a breach occurs.
Delay by law enforcement: The Information Regulator may direct a responsible party to delay notifying data subjects if doing so would impede a criminal investigation. However, the notification to the Regulator itself cannot be delayed.

Technology companies should maintain a documented incident response plan that includes clear escalation procedures, pre-drafted notification templates, designated spokespersons, and a communication strategy for both regulatory and public-facing notifications. The speed and professionalism of a company's breach response can significantly influence both the regulatory outcome and the company's reputation.

Cross-Border Data Transfers

Section 72 of POPIA restricts the transfer of personal information outside the borders of South Africa. This provision has particular significance for technology companies, many of which use international cloud infrastructure (AWS, Microsoft Azure, Google Cloud) or partner with service providers in other jurisdictions.

When Cross-Border Transfer is Permitted

POPIA permits the transfer of personal information to a foreign country only in the following circumstances:

Adequate protection: The recipient country provides an "adequate level of protection" for personal information. The Information Regulator has not yet published a definitive list of countries deemed adequate, but countries with GDPR-equivalent legislation (such as EU and EEA member states) are generally considered to meet this threshold.
Binding agreement: The recipient is subject to a binding agreement that provides an adequate level of protection that effectively upholds principles for the reasonable processing of personal information substantially similar to POPIA's conditions for lawful processing.
Consent: The data subject consents to the transfer after being informed of the potential risks.
Contractual necessity: The transfer is necessary for the performance of a contract between the data subject and the responsible party, or for the implementation of pre-contractual measures taken in response to the data subject's request.
Benefit of the data subject: The transfer is for the benefit of the data subject and it is not reasonably practicable to obtain their consent.

For technology companies using international cloud providers, the most practical approach is typically the "binding agreement" mechanism. This means ensuring that the cloud provider's terms of service or data processing agreement contains provisions that substantively mirror POPIA's conditions for lawful processing. Major cloud providers have increasingly updated their agreements to accommodate data protection requirements from multiple jurisdictions, but South African technology companies should verify that the specific terms are adequate for POPIA compliance and not simply assume that GDPR-compliant terms are sufficient.

POPIA and GDPR -- How They Interact

South African technology companies that serve clients in the European Union or process the personal data of EU residents face the challenge of complying with both POPIA and the EU's General Data Protection Regulation (GDPR). While the two frameworks share common principles -- both are based on the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data -- there are important differences that technology companies must navigate.

Key Similarities

Both POPIA and the GDPR require a lawful basis for processing personal information, mandate data protection impact assessments for high-risk processing, require breach notification to the relevant supervisory authority, grant data subjects rights of access, correction, and deletion, and impose restrictions on cross-border data transfers. A technology company that achieves full GDPR compliance will have addressed the majority of POPIA's requirements, although certain South Africa-specific provisions still require attention.

Key Differences

Several important differences exist between POPIA and the GDPR that technology companies must be aware of:

--Scope of application: POPIA applies to the processing of personal information of identifiable, living natural persons and existing juristic persons (companies). The GDPR applies only to natural persons. This means South African technology companies must protect company data as well as individual data.
--Terminology: POPIA uses "responsible party" and "operator" where the GDPR uses "controller" and "processor." While functionally similar, the exact definitions differ slightly.
--Data Protection Officer vs Information Officer: Under the GDPR, a Data Protection Officer (DPO) is required only in certain circumstances. Under POPIA, every responsible party must designate an Information Officer, and that officer must be registered with the Information Regulator.
--Lawful bases for processing: POPIA recognises "legitimate interest" as a lawful basis for processing but frames it differently from the GDPR. Technology companies cannot simply transpose their GDPR Article 6(1)(f) analyses to POPIA without careful review.
--Direct marketing: POPIA's direct marketing provisions (section 69) differ from the GDPR's approach. POPIA generally requires opt-in consent for direct marketing by electronic means, with a limited exception for existing customer relationships.

The practical approach for technology companies operating across both jurisdictions is to implement a unified data protection framework that satisfies the more stringent requirement of each law on a provision-by-provision basis. This "highest common denominator" approach ensures compliance with both frameworks while avoiding the complexity and cost of maintaining separate compliance programmes.

Penalties and Enforcement

POPIA's enforcement provisions are substantial and should not be underestimated by technology companies. The Information Regulator has demonstrated an increasing willingness to investigate complaints, conduct assessments, and take enforcement action.

Enforcement Mechanisms

Administrative fines: The Information Regulator may impose administrative fines of up to R10 million for non-compliance. In determining the quantum, the Regulator will consider the nature, gravity, and duration of the infringement, the number of data subjects affected, the degree of damage suffered, and the measures taken by the responsible party to mitigate the damage.
Criminal sanctions: Certain contraventions of POPIA are criminal offences, punishable by a fine or imprisonment for a period not exceeding 10 years, or both. These include knowingly or recklessly obtaining or disclosing an account number of a data subject, and hindering, obstructing, or unlawfully influencing the Information Regulator.
Civil claims: Section 99 of POPIA grants data subjects the right to institute civil proceedings for damages suffered as a result of a contravention of POPIA. This includes both patrimonial loss and non-patrimonial loss (such as injury to dignity or emotional distress). Class action suits are also possible where multiple data subjects are affected by the same breach.
Enforcement notices: The Information Regulator may issue enforcement notices directing a responsible party to take specific steps to comply with POPIA within a specified period. Failure to comply with an enforcement notice is itself an offence.

Beyond statutory penalties, the reputational damage from a publicised data breach or regulatory enforcement action can be devastating for technology companies, whose business model depends on customer trust. The Information Regulator's public statements and media engagements have made it clear that technology companies are a priority sector for enforcement activity.

Practical Compliance Steps for Tech Companies

Achieving POPIA compliance is not a one-time project but an ongoing governance function. The following steps provide a practical roadmap for technology companies at any stage of their compliance journey.

1

Conduct a Data Mapping Exercise

Identify all personal information processed by your organisation, including the categories of data subjects, the types of personal information, the sources of data, the purposes of processing, the legal basis for each processing activity, and the third parties with whom data is shared. This exercise is the foundation of all other compliance activities and should be updated regularly.

2

Appoint and Register Your Information Officer

Designate a suitably qualified Information Officer and register them with the Information Regulator. The Information Officer is responsible for encouraging compliance within the organisation, handling data subject access requests, and working cooperatively with the Regulator. Consider appointing Deputy Information Officers for different business units or data processing activities.

3

Implement Appropriate Security Measures

Section 19 of POPIA requires responsible parties to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures. For technology companies, this includes encryption at rest and in transit, multi-factor authentication, role-based access controls, regular vulnerability assessments and penetration testing, secure software development lifecycle (SDLC) practices, and regular security awareness training for all staff.

4

Review and Update All Agreements

Ensure that operator agreements are in place with all third-party service providers that process personal information on your behalf. Review your customer-facing terms of service, privacy policies, and cookie notices to ensure they accurately reflect your data processing activities and comply with POPIA's transparency requirements.

5

Establish an Incident Response Plan

Develop a documented data breach response plan that includes clear roles and responsibilities, escalation procedures, notification templates for the Information Regulator and data subjects, a communication strategy for media and stakeholder enquiries, and a post-incident review process. Test the plan regularly through tabletop exercises and simulations.

6

Build Privacy Into Product Design

Adopt a privacy-by-design approach, integrating data protection considerations into every stage of product development. This includes conducting privacy impact assessments for new features or products, implementing data minimisation principles, providing granular consent controls for end users, building data portability and deletion functionality into your platform, and documenting privacy decisions as part of your SDLC.

7

Train Your Team

POPIA compliance depends on human behaviour as much as technology. All staff -- not just developers and engineers, but sales, marketing, customer support, and management -- should receive regular training on data protection principles, the organisation's data handling policies, and their individual obligations under POPIA.

POPIA as a Competitive Advantage

While POPIA compliance requires investment in time, resources, and expertise, forward-thinking technology companies recognise that robust data protection is not merely a legal obligation but a competitive differentiator. In a market increasingly shaped by data breaches and privacy concerns, the ability to demonstrate genuine commitment to data protection can be a decisive factor in winning and retaining clients.

South African technology companies that invest in comprehensive POPIA compliance today will be better positioned to expand into GDPR-regulated markets, win enterprise clients with stringent procurement requirements, and build the trust that underpins long-term customer relationships. The cost of compliance is always less than the cost of non-compliance.

POPIA Compliance for Technology Companies

Contents