Virtually all of the remaining provisions of the Protection of Personal Information Act 4 of 2013 (POPIA) are finally set to commence according to an announcement by President Ramaphosa this morning, 22 June 2020. The announcement comes after a 6 year wait since April 2014, when certain provisions of POPIA commenced, such as those provisions that established the office of the Information Regulator, and set out the office's powers, functions and duties, as well as those provisions which enable the Minister to make various regulations under POPIA.
According to the announcement by President Ramaphosa, the 12 month countdown to POPIA compliance will commence on 1 July 2020. In other words, private and public bodies, and anyone else who determines the purpose of, and means for, processing personal information will have until 30 June 2021 by which to comply with the comprehensive requirements set out in POPIA.
According to the announcement by President Ramaphosa, all of the operational provisions of POPIA will officially commence on
1 July 2020, except for two provisions, sections 110 and 114(4), which will only commence on 30 June 2021. These two sections deal with the amendment of laws and the transition of certain powers from the South African Human Rights Commission to the Information Regulator, respectively.
The operational provisions which will commence on 1 July 2020 (with the 12 month transition period mentioned above) are:
- the 8 conditions of lawful processing;
- the appointment and obligations of the information officer;
- rights of individuals regarding direct marketing by means of unsolicited electronic communications and automated decision making;
- provisions regarding the transfer of personal information outside of South Africa;
- enforcement provisions; and
- offences, penalties and administrative fines.
