{"id":2629,"date":"2020-07-28T15:36:18","date_gmt":"2020-07-28T14:36:18","guid":{"rendered":"https:\/\/staging.techgdpr.com\/?p=2629"},"modified":"2024-02-22T17:10:00","modified_gmt":"2024-02-22T16:10:00","slug":"a-comparison-of-popia-and-gdpr-in-key-areas","status":"publish","type":"post","link":"https:\/\/techgdpr.com\/blog\/a-comparison-of-popia-and-gdpr-in-key-areas\/","title":{"rendered":"A Comparison of POPIA and GDPR in Key Areas"},"content":{"rendered":"\n

South Africa’s Protection of Personal Information Act<\/a> (POPIA) will see its final sections go into effect on 30 June 2021. Furthermore, parties subject to POPIA must be fully compliant with the guidelines by 1 July 2021. A number of them may have a head start if they already adhere to established data protection guidelines such as the European Union’s General Data Protection Regulation (GDPR). However, they may still be unaware about the extent to which they must adapt to POPIA. This article therefore provides a comparison of POPIA and GDPR to provide a helpful guide for parties subject to both regulations.<\/span><\/p>\n\n\n\n

GDPR and POPIA are fairly similar overall, albeit with some differences in terminology, organisation of the respective articles, and greater specificity on the part of GDPR.<\/span><\/p>\n\n\n\n

Key Definitions in GDPR and POPIA<\/span><\/h2>\n\n\n\n
\n

Key Terms
<\/strong><\/span><\/h4>\n<\/td>

\n

Definition<\/b><\/span><\/h4>\n<\/td><\/tr>

\n
Personal information (POPIA) <\/strong><\/span><\/h5>\n
Personal data (GDPR)
<\/strong><\/span><\/h5>\n<\/td>
Information relating to an identifiable, living, and natural person.<\/span>\n

POPIA also includes juristic persons, where applicable.<\/strong><\/em><\/span><\/p>\n<\/td><\/tr>

\n
Processing<\/strong><\/span><\/h5>\n<\/td>
Any operation or activity or any set of operations, whether or not by automatic means, concerning personal information. This includes:<\/span>\n
    \n
  • Collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use<\/span><\/li>\n
  • Dissemination by means of transmission, distribution or making available in any other form<\/span><\/li>\n
  • Merging, linking, as well as restriction, degradation, erasure or destruction of information<\/span><\/li>\n<\/ul>\n<\/td><\/tr>
\n
Consent<\/strong><\/span><\/h5>\n<\/td>
Any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information.<\/span>\n

POPIA also mentions that it is \u201csubject to interpretation regarding what constitutes a voluntary expression of will\u201d<\/strong><\/em><\/span><\/p>\n<\/td><\/tr>

\n
Data Subject<\/strong><\/span><\/h5>\n<\/td>
The person to whom personal information relates.<\/span><\/td><\/tr>
\n
Responsible Party (POPIA) Data Controller (GDPR)<\/b><\/span><\/h5>\n<\/td>
A public, private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information.<\/span><\/td><\/tr>
\n
Data Processor (GDPR)<\/b><\/span><\/h5>\n<\/td>
A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.<\/span>\n

There is no concept of a data processor in POPIA, so the responsible party appears to be the sole party liable for POPIA violations.<\/strong><\/em><\/span><\/p>\n<\/td><\/tr>

\n
Information Regulator (POPIA) <\/b><\/span><\/h5>\n
Supervisory Authority (GDPR)<\/b><\/span><\/h5>\n<\/td>
A juristic person with jurisdiction throughout the republic\/member state, is subject only to the constitution, must perform its functions in accordance with POPIA\/GDPR, and is accountable to the National Assembly.<\/span>\n

A key difference between the Information Regulator and Supervisory Authority is explained below. <\/strong><\/em><\/span><\/p>\n<\/td><\/tr>

\n
Information Officer<\/strong><\/span><\/h5>\n<\/td>
South Africa\u2019s pre-existing data protection regulation established under the Promotion of Access to Information Act (PAIA). The responsible party is obliged to notify the designation of the Information Officer to the Regulator. Responsibilities of the IO include:<\/span>\n
    \n
  • Encouraging compliance with POPIA and the conditions for lawful processing<\/span><\/li>\n
  • Dealing with any request made to the organisation.<\/span><\/li>\n<\/ul>\n

    However, it is unclear what “any request\u201d covers. <\/strong><\/em><\/span><\/p>\n

      \n
    • Cooperating with the Information Regulator in respect of any investigation<\/span><\/li>\n<\/ul>\n

      The comparable GDPR term is the Data Protection Officer. However, the IO is responsible for ensuring compliance with POPIA while the DPO must supervise and consult, but remain independent.<\/strong><\/em><\/span><\/p>\n<\/td><\/tr>

\n
Deputy Information Officer<\/b><\/span><\/h5>\n<\/td>
A person(s) to be designated in accordance with Art. 56 to help the Information Officer perform his\/her tasks. <\/b><\/span>\n

There is no mention of a comparable person in This is not set out in the GDPR.<\/strong><\/em><\/span><\/p>\n<\/td><\/tr>

\n
Special Personal Information (POPIA)<\/b><\/span><\/h5>\n
Special Categories of Personal Data (GDPR)
<\/b><\/span><\/h5>\n<\/td>
The religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject.<\/span>\n

The criminal behaviour of a data subject to the extent that such information relates to alleged offenses. Additionally, a<\/span>ny proceedings in respect of any offence allegedly committed by a data subject or the disposal of such proceedings.<\/span><\/p>\n

POPIA and GDPR have the same content here, but POPIA puts criminal offenses under the category of special personal information, while the GDPR dissociates the two concepts.
<\/i><\/b><\/span><\/p>\n<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

A key difference between the Information Regulator (POPIA) and the Supervisory Authority (GDPR)<\/span><\/h2>\n\n\n\n

Responsible parties under POPIA must obtain authorisation from the Regulator in order to:<\/span><\/p>\n\n\n\n