South Africa

In South Africa, the legislative basis for data processing principles is defined by the Protection of Personal Information Act (POPIA), where all organizations are required to have a Legitimate Basis when processing any personal data, mostly using consent, contractual necessity, legal obligation, or legitimate interests. According to Section 18, organizations are required to present the Privacy Notice understandably at the time of collecting data by providing details on the type of data being processed, purposes of processing, and recipients of such data. In addition, POPIA grants the rights to individuals and juristic persons to request their rights regarding their data being processed as Data Subjects. Data Subjects have the right to access personal information, refuse direct marketing, as well as require that inaccurate, irrelevant, or unlawfully processed data be corrected or destroyed. The failure to comply with the transparency principles, unlawful processing, or disregarding the data subject rights is an offense that will be punished by the Information Regulator with a fine of up to R10 million or imprisonment of up to 10 years.

In South Africa, the legal requirement for handling security breaches is clearly spelt out in Section 22 of the Protection of Personal Information Act (POPIA), requiring organizations to promptly notify of unauthorized access to personal information whenever it is discovered [Protection of Personal Information Act Overview]. It means that the organization must notify both the independent Information Regulator and the Data Subjects of the potential risks, actions taken to mitigate such risks, and measures for consumer protection in clear and understandable language [Information Regulator Website]. The third parties involved (Operators) are required to promptly notify the organization of any security breach, thus placing the obligation on the primary organization to make the notification. Failure to notify the regulatory authority and consumers promptly, or even covering up the security breach, is a serious offense punishable with independent administrative fines of up to R10 million, or civil class-action lawsuits or imprisonment for a period of up to ten years.