POPIA Code.pdf

Key Points:

1. Purpose: The Code aims to apply POPIA principles to the higher education industry, empowering it and clarifying POPIA requirements.
2. Scope: The Code applies to all public universities in South Africa, which must comply with POPIA by 30 June 2021.
3. Status: The Code is currently a voluntary guideline, adopted by Universities South Africa, but intends to be accredited by the Information Regulator.
4. Principles: The Code outlines 22 principles for lawful processing of personal information, including:
Establishing responsibility for compliance
Specific, explicit, and documented purposes for processing
Legal basis for processing
Authorization for processing special personal information
Justification for processing children's information
Compatible secondary processing purposes
Minimal processing
Lawful source of personal information
Transparency
Information classification
Record-keeping
Information quality
Information security
Retention periods
Restriction of personal information
Managed sharing and third parties
Access to information management
Data subject rights
Use of identifiable personal information in scientific research
Direct marketing and donations
Automated decision-making rules
Information matching programs
5. Compliance Structures and Frameworks: The Code outlines compliance roles, frameworks, and personal information impact assessments.

Important Dates:

1. 1 July 2020: Sections 2 to 28, 55 to 109, section 111, and section 114(1) – (3) of the POPIA come into force.
2. 30 June 2021: Section 110 and section 114(4) of the POPIA come into force, and public universities must be fully compliant with the POPIA.