The Protection of Personal Information Act (or POPI Act) is South Africa’s equivalent of the EU GDPR.
The Act applies to any person or organisation who keeps any type of records relating to the personal information of anyone, unless those records are subject to other legislation which protects such information more stringently.
It therefore sets the minimum standards for the protection of personal information. It regulates the “processing” of personal information. “Processing” includes collecting, receiving, recording, organizing, retrieving, or using such information; or disseminating, distributing or making such personal information available.
The Act will also relate to records which are already in the possession of the entity or person doing the processing.