KYOCERA Document Solutions South Africa Pty Ltd will:
- Process and store personal data securely and minimise access to this data.
- Where personal data is no longer required and where there is no current user consent, the data is then removed and deleted.
- Data will only be used for the intended purpose, for example: to keep in touch with the Kyocera Partner network; or to resolve an enquiry; or to facilitate effective account management and/or SLAs; or to assist persons with their requests.
- Respond to ‘Subject Access Requests’.
- Report any breaches or loss of personal data both to regulators and individuals.
About the POPI Act
The Protection of Personal Information Act (or POPI Act or POPIA) is South Africa's equivalent of the EU GDPR. It sets some conditions for responsible parties (called controllers in other jurisdictions) to lawfully process the personal information of data subjects (both natural and juristic persons).
POPIA was signed into law in 2013. Officially, it has commenced from the 1st of July 2020 with a grace period of 12 months. From the 1st of July 2021, compliance to the POPI Act is expected, and shall be actively enforced.
The POPI Act protects natural persons and companies, and therefore, not only does it apply to big businesses, it applies to small, medium and large companies, as well as all individuals.
The Protection of Personal Information Act 4 of 2013 aims:
- to promote the protection of personal information processed by public and private bodies;
- to introduce certain conditions so as to establish minimum requirements for the processing of personal information;
- to provide for the establishment of an Information Regulator to exercise certain powers and to perform certain duties and functions in terms of this Act and the Promotion of Access to Information Act, 2000;
- to provide for the issuing of codes of conduct;
- to provide for the rights of persons regarding unsolicited electronic communications and automated decision making;
- to regulate the flow of personal information across the borders of the Republic; and
- to provide for matters connected therewith.
Personal information - is any type of information that relates to a person or that can identify a person, such as gender, race, marital status, nationality, ethnicity, sex, mental health, religion, sexual orientation language, education, financial, criminal, medical, employment, biometrics, DNA, retinal, blood type, email, telephone number, location information, private correspondence, opinions or views, name, ID number, etc.
The POPI Act is important because it protects data subjects from harm, like theft and discrimination. The risks of non-compliance include reputational damage, fines and imprisonment, and paying out damages claims to data subjects. The biggest risk, after reputational damage, is a fine for failing to protect account numbers.
The Act regulates how personal information may be processed, by establishing conditions that meet international standards for the lawful processing thereof, namely:
- Accountability;
- Processing limitation;
- Purposes specification;
- Further processing limitation;
- Information quality;
- Openness;
- Security safeguards; and
- Data subject participation.
