When you have completed all instructions in the toolkit you should be compliant. The way to test this is if you can answer yes to all the questions and statements in the gap analysis provided.

POPI compliance is self-regulatory. Not even the Information Regulator can give you a certificate of compliance. That's why we like the certificate of assurance as it merely states that your company adhere to the law as best you can.

Short story is you keep your POPI Manual on File and continuously make sure that you are living POPI every day.

If you are using direct electronic marketing (automatic calling machines, facsimile machines, SMS's and other types of text messages, as well as emails) you need the prior consent of data subjects - this consent you need to obtain by using Form 4. The data subject must tick the box to agree to receiving this information, and sign the document. Please keep this as proof.

If you are sending this communication to current clients / customers to whom you have sold a similar product or service before, you may approach them electronically and allow them the opportunity to opt out.

Please see an extract from the act below:

69 Direct marketing by means of unsolicited electronic communications

(3) A responsible party may only process the personal information of a data subject who is a customer of the responsible party in terms of subsection (1) (b)-
(a) if the responsible party has obtained the contact details of the data subject in the context of the sale of a product or service;
(b) for the purpose of direct marketing of the responsible party's own similar products or services; and
(c) if the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its electronic details-
(i) at the time when the information was collected; and
(ii) on the occasion of each communication with the data subject for the purpose of marketing if the data subject has not initially refused such use.
(4) Any communication for the purpose of direct marketing must contain-
(a) details of the identity of the sender or the person on whose behalf the communication has been sent; and
(b) an address or other contact details to which the recipient may send a request that such communications cease.

In terms of the act, a responsible party may only transfer personal information about a data subject to a third party (supplier, in this case) in another country if adequate levels of protection are provided in one of the following ways:

1. Appropriate laws in the foreign country (e.g. GDPR in the EU)
2. If the entity with which information is shared can prove they are bound by corporate rules
3. If there is a binding agreement between the responsible party and the foreign entity (supplier) about the processing of personal information, including limitation on the further transfer by the recipient.

The factors mentioned above should be sufficiently similar to the POPI legislation in order to ensure secure processing of personal information.

If the data subject consents to the transfer of personal information, or the transfer is necessary in the performance or conclusion of a contract between the responsible party and the data subject, the information can also be shared.

The principle here is about accountability, one of the 8 conditions of the act. In terms of the example below, the entity to which personal information was entrusted, is accountable (not the individual).

The entity can minimize risk by:

• Limiting access only to trustworthy employees within the entity/third parties
• Ensuring that employees are aware of the risks (together with proof that the entity ensured that employees are aware of risk)
• Taking steps immediately after a breach has taken place to investigate fully what has taken place, and ensuring the necessary reporting takes place after the investigation