NISSAN SOUTH AFRICA PROPRIETARY LIMITED (“NSA”) POPIA COMPLIANCE UPDATE
The Protection of Personal Information Act, 4 of 2013 (“POPIA”) came into effect on 1 July 2020. POPIA regulates how personal information of natural and juristic entities must be processed (“data subjects”) and sets out certain obligations that must be complied with when processing personal information.
POPIA provides for a 1 year grace period during which a responsible party (party responsible for processing the personal information of data subjects) must ensure compliance with the provisions of POPIA.
What is NSA doing in order to ensure compliance with POPIA?
The responsible party must implement measures to ensure compliance with the lawful processing conditions
2. Processing Limitation
The purpose of the processing of personal information must be justifiable and must take place in a lawful, reasonable and non-excessive manner.
3. Purpose Specification
Personal information must be collected and processed for a specific and defined purpose
4. Further Processing Limitation
Personal information may not be processed for a further purpose where such purpose is not compatible with the original purpose of the collection or where so authorised by the Information Regulator
5. Information Quality
The responsible party must ensure the personal information being processed is complete, accurate, not misleading and updated where necessary
The responsible party must notify the data subject of its processing activities
7. Security Safeguards
The responsible party must implement security safeguards to ensure the integrity and confidentiality of the personal information is protected
8. Data Subject Participation
Data subjects have certain rights in terms of their personal information held by a responsible party, which includes requesting access thereto and the correction or deletion thereof.
NSA has compiled a robust POPIA Compliance Programme that is currently being rolled out internally which addresses the abovementioned lawful processing conditions as well as all other requirements set out under POPIA.
NSA POPIA Compliance Programme:
Under the POPIA Compliance Programme, NSA has:
Reviewed its internal processes and created new processes to ensure compliance with the lawful processing conditions, including processes related to the collection, storage and destruction of personal information;
Updated our internal policies to allow for the monitoring of compliance with the provisions of POPIA;
Reviewed and updated all our agreements to provide for data privacy and protection in accordance with the requirements of POPIA;
Implementing new and updating current security safeguards to ensure the proper protection of personal information processed by NSA;
Created a process which allows data subjects to request access to, or the correction or deletion of their personal information held by NSA;
Provided training to the various business areas within NSA to ensure they remain aware and up to date of their obligations under POPIA;
Created a Privacy Statement to ensure data subjects are notified of all of NSA’s processing activities in relation to their personal information;
Improved NSA’s security and data breach processes to meet the requirements of POPIA.
What is the impact of POPIA on NSA’s stakeholders, business partners, customers, dealers, suppliers, service providers and other third parties?
NSA is committed to protecting individual and corporate personal information. NSA will only process personal information in accordance with the provisions of POPIA and other applicable data privacy legislation.
In order to ensure compliance, NSA may contact you to request consent for specific processing activities, require you to sign a new agreement or addendum to provide for data privacy provisions, ask you to complete an additional form or document, request you to verify and/or update your personal information or any other ad-hoc request which relates to complying with the provisions of POPIA.