POPIA

Per South African Protection of Personal Information Act (POPIA) 2013 Sections 8-11 + Accountability + Lawfulness conditions: foundation for processing. Requirements include (a) implement Accountability (Section 8) - the responsible party must ensure conditions for lawful processing are complied with + (b) implement Processing Limitation Lawfulness (Section 9) processing must be lawful + done in a manner that does not infringe data subject privacy + (c) implement Minimality (Section 10) - processing must be adequate + relevant + not excessive + (d) implement Consent, Justification, Objection (Section 11) per lawful basis + (e) maintain Codes of Conduct Adherence where industry codes apply + (f) document applicability + lawful basis + (g) align with Information Regulator guidance.

• POPIA evidence for POPIASA-1

• Information Officer + transborder safeguards + breach notification partial

Per POPIA + Information Regulator: enforcement + cooperation. Requirements include (a) cooperate with Information Regulator including responding to inquiries + facilitating audits + complying with directives + (b) operate Complaints Handling and Resolution mechanism enabling complaints to responsible party + Information Regulator + (c) maintain Compliance Monitoring and Auditing including periodic review + internal audit + reporting to leadership + (d) maintain Enforcement and Penalties awareness including administrative fines + civil liability + criminal penalties + (e) maintain Regulatory Reporting and Cooperation + (f) integrate with broader compliance + governance.

• POPIA evidence for POPIASA-8

• Information Officer + transborder safeguards + breach notification partial

Per POPIA + Information Regulator guidance: governance + lifecycle. Requirements include (a) designate Information Officer where required - includes head of public + private body + delegated functions per POPIA + (b) maintain records of processing activities + (c) implement Notification to Data Subject (Section 18) - data subject must be notified of collection including identity of responsible party + purposes + recipients + retention + rights + (d) implement retention + disposal aligned to purpose + legal obligations + (e) deliver Training and Awareness across personnel + (f) maintain documented governance + accountability + (g) integrate with broader privacy programme.

• POPIA evidence for POPIASA-7

• Information Officer + transborder safeguards + breach notification partial

Per POPIA Sections 16-17 + 26 + 34: heightened safeguards. Requirements include (a) implement Special Personal Information (Section 26) protections - religious + race/ethnicity + trade union + political + health + sexual life + biometric + criminal behaviour require prohibition or specific consent + lawful basis + (b) implement Children (Section 34) protections requiring competent person consent for children under 18 + (c) implement Information Quality (Section 16) - personal information must be complete + accurate + up to date + (d) maintain Documentation (Section 17) of processing operations + (e) maintain documented risk assessments + (f) integrate with broader privacy programme.

• POPIA evidence for POPIASA-4

• Information Officer + transborder safeguards + breach notification partial

Per POPIA Sections 23-25 + 71: data subject rights. Requirements include (a) implement Access to Personal Information (Section 23) - data subjects have right to be informed of processing + obtain copy of records + (b) implement Correction of Personal Information (Section 24) - data subjects can request correction or deletion + (c) implement Automated Decision Making (Section 71) protections - data subjects cannot be subject to a decision based solely on automated processing that has significant effects + (d) implement Right to Object (Section 11 + 69) including for direct marketing + (e) maintain mechanism for receiving + verifying + responding to requests within statutory timelines + (f) maintain records of requests + responses.

• POPIA evidence for POPIASA-3

• Information Officer + transborder safeguards + breach notification partial

Per POPIA Sections 12-15: purpose + collection + further processing. Requirements include (a) implement Collection Directly from Data Subject (Section 12) - personal information must be collected directly from the data subject + with limited exceptions + (b) implement Purpose Specification (Section 13) - information must be collected for a specific + explicitly defined + lawful purpose + (c) implement Further Processing Limitation (Section 15) - further processing must be in accordance with or compatible with the original purpose + (d) provide notice to data subjects per Section 18 + (e) maintain records of collection sources + purposes + further processing decisions + (f) maintain change management.

• POPIA evidence for POPIASA-2

• Information Officer + transborder safeguards + breach notification partial

Per POPIA Sections 19-22: security safeguards + operator obligations + breach. Requirements include (a) implement Security Safeguards (Section 19) - responsible party must secure personal information against loss + damage + unauthorised destruction + access + by taking appropriate technical + organisational measures + (b) maintain Operator Obligations (Section 20-21) - operators process personal information only with knowledge or authorisation of responsible party + maintain confidentiality + secure processing + (c) implement encryption + access control + activity logging where appropriate + (d) implement Security Compromise Notification (Section 22) - notify Information Regulator + affected data subjects of security compromise without undue delay + (e) integrate with broader information security programme + (f) maintain operator due diligence.

• POPIA evidence for POPIASA-5

• Information Officer + transborder safeguards + breach notification partial

Per POPIA Sections 69 + 72: transfer + marketing. Requirements include (a) implement Transborder Flows (Section 72) restrictions - personal information may be transferred outside South Africa only where (i) third party subject to law or binding corporate rules providing equivalent protection + (ii) data subject consents + (iii) transfer necessary for contract performance + (iv) transfer for benefit of data subject + (b) maintain documentation of cross-border data flows + safeguards + (c) implement Direct Marketing (Section 69) restrictions - direct marketing by means of unsolicited electronic communications prohibited except where data subject has consented + is a customer of the responsible party + (d) implement opt-out mechanisms + (e) maintain inventory of transfers + (f) cooperate with Information Regulator on transfer matters.

• POPIA evidence for POPIASA-6

• Information Officer + transborder safeguards + breach notification partial