With the POPIA deadline approaching, don't take your eyes off PAIA

• Africa

• Corporate - International corporate knowledge briefing
• Media - Briefing notes
• Public law
• Technology - Articles
• Telecoms - articles

28-06-2021

The Protection of Personal Information Act 4 of 2013 (“POPIA”) became effective on 1 July 2020 and the grace period extended to allow both individuals and businesses to become compliant is set to end on 1 July 2021.

In recent months, the wave of “POPIA Panic” has taken hold as the end of the grace period nears. In the background, POPIA’s sister legislation, the Promotion of Access to Information Act 2 of 2000 (“PAIA”) has, in anticipation of the end of the POPIA grace period, quietly changed the dispensation surrounding the requirement to have a PAIA manual.

The PAIA Manual

In terms of section 51 of PAIA, all private bodies (which includes public companies) are required to compile a PAIA manual, which needs to be made available on their website and submitted to the South African Human Rights Commission (“SAHRC”).

There is currently an exemption to section 51 of PAIA, which exempts certain private bodies from complying with the requirement to compile and submit a PAIA manual. The exemption relates to the number of employees of a business as well as its annual turnover. In our experience, many smaller businesses have relied upon this exemption to avoid the administrative burden of compiling a PAIA manual.

The Changes

The exemption referred to above has been continuously renewed by the Minister of Justice and Correctional Services (“the Minister”). Recently, the Minister announced a further renewal until 30 June 2021. The exemption period is substantially shorter to that which has been announced previously, and the expiry date is all too coincidental. It seems clear that the intention is that, to align with POPIA, all private bodies shall be required to compile, make available and submit a PAIA manual.

Furthermore, on 30 June 2021, POPIA shall amend substantive portions of PAIA relating to PAIA manuals, which will now need to include information relating to the private bodies’ data processing and protection mechanisms. The PAIA manual, in essence, will be a hybrid PAIA/POPIA manual and will now need to be submitted to the Information Regulator under POPIA (as opposed to the SAHRC).

The Upside

It is uncertain whether the Minister will grant a further exemption period, however, you still have some time if your business has been relaying on the exemption to date. We are well versed with the requirements of POPIA and PAIA and are able to assist with any of your compliance requirements, including the drafting of your PAIA/POPIA manual.