KYOCERA Document Solutions South Africa Pty Ltd will:

• Process and store personal data securely and minimise access to this data.
• Where personal data is no longer required and where there is no current user consent, the data is then removed and deleted.
• Data will only be used for the intended purpose, for example: to keep in touch with the Kyocera Partner network; or to resolve an enquiry; or to facilitate effective account management and/or SLAs; or to assist persons with their requests.
• Respond to ‘Subject Access Requests’.
• Report any breaches or loss of personal data both to regulators and individuals.

About the POPI Act

The Protection of Personal Information Act (or POPI Act or POPIA) is South Africa's equivalent of the EU GDPR. It sets some conditions for responsible parties (called controllers in other jurisdictions) to lawfully process the personal information of data subjects (both natural and juristic persons).

POPIA was signed into law in 2013. Officially, it has commenced from the 1st of July 2020 with a grace period of 12 months. The Protection of Personal Information Act, 2013 (“POPIA”) came into complete commencement on 1 July 2021

The POPI Act protects natural persons and companies, and therefore, not only does it apply to big businesses, it applies to small, medium and large companies, as well as all individuals.

The Protection of Personal Information Act 4 of 2013 aims:

• to promote the protection of personal information processed by public and private bodies;
• to introduce certain conditions so as to establish minimum requirements for the processing of personal information;
• to provide for the establishment of an Information Regulator to exercise certain powers and to perform certain duties and functions in terms of this Act and the Promotion of Access to Information Act, 2000;
• to provide for the issuing of codes of conduct;
• to provide for the rights of persons regarding unsolicited electronic communications and automated decision making;
• to regulate the flow of personal information across the borders of the Republic; and  
• to provide for matters connected therewith.

Personal information refers to any information that identifies you or specifically relates to you. Personal information includes, but is not limited to, the following information about you:

Age, belief, birth, biometric, colour, conscience, correspondence, criminal history, culture, disability, education, e-mail address, employment history, ethnic origin, financial history, gender, identity number, language, location information, marital status, mental health, medical history, name, national origin, online identifier, other particular assignment, personal opinions, personal preferences, personal views, physical address, physical health, pregnancy, race, religion, sex, sexual orientation, social origin, symbol, telephone number and well-being. 

The POPI Act is important because it protects data subjects from harm, like theft and discrimination. The risks of non-compliance include reputational damage, fines and imprisonment, and paying out damages claims to data subjects. The biggest risk, after reputational damage, is a fine for failing to protect account numbers.

The Act regulates how personal information may be processed, by establishing conditions that meet international standards for the lawful processing thereof, namely:

• Accountability;
• Processing limitation;
• Purposes specification;
• Further processing limitation;
• Information quality;
• Openness;
• Security safeguards; and
• Data subject participation.