The Protection of Personal Information Act (POPI) regulates how personal information can be processed and establishes conditions for lawful processing. It aims to protect personal information and balance privacy rights with other rights like access to information. The POPI Act applies broadly to any party that collects, holds, or uses a person's information. It impacts procurement processes by requiring consent for personal information use, only collecting relevant data, and maintaining security. Non-compliance can result in fines, damages lawsuits, and reputational harm.

1. THE PROTECTION Of PERSONAL INFORMATION (POPI) Act 4 of 2013
The Implications of
The Protection of Personal Information Act (POPI)
for
Integrated Supply Chain Management (iSCM)
Presented by: Myron D. B. Betshanger
Corporate Governance, Legal & Regulatory Compliance Specialist

2. CONTENT
1.The purpose of the Protection of Personal Information
Act (POPI) Act
2.Application of The POPI Act
3. Definitions In The POPI Act
4.Condition For Legal Processing of Personal Information
5.Impact Of The POPI Act on Procurement Process
6.Consequences For Non-Compliance

3. The purpose of the Protection of Personal Information Act (POPI) is to:
 give effect to the constitutional right to privacy, by safeguarding personal information
when processed by a responsible party, subject to justifiable limitations that are
aimed at:
 balancing the right to privacy against other rights, particularly the right of access
to information; and
 protecting important interests, including the free flow of information within the
Republic and across international borders.
 regulate the manner in which personal information may be processed, by
establishing conditions, in harmony with international standards that prescribe the
minimum threshold requirements for the lawful processing of personal information;
 provide persons with rights and remedies to protect their personal information from
processing that is not in accordance with this Act
PURPOSE of The POPI Act

4. APPLICATION of The POPI Act
 As a result of the POPI Act, any party that collects, holds and uses a
person’s personal information will have to do so under certain
circumstances.
 The requirements will apply to personal information that is held in
relation to employees, customers, suppliers as well as prospective
customers and prospective suppliers (i.e. bidders) for supply
contracts.

5. POPI Act DEFINITIONS
WHAT IS PERSONAL INFORMATION FOR PURPOSES OF POPI ?
 “ Personal Information” is information relating to an identifiable, living natural person or juristic
person as far as applicable.
 POPI defines “personal information” very broadly to include, but which is not limited to the
following –
i. Information relating to the race, gender, sex, pregnancy, marital status, national, ethic or social origin,
colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience,
belief, culture, language and birth of the person;
ii. Information relating to the education or the medical, financial, criminal or employment history of the
person;
iii. any identification number, symbol, e-mail address, physical address, telephone number, location
information, online identifier or other particular assignment to the person;
iv. the biometric information of the person;
v. the personal opinions, views or preferences of the person;
vi. correspondence send by that person that is implicitly or explicitly of a private or confidential nature or
further correspondence that would reveal the contents of the original correspondence;
vii. the views or opinions of another individual about the person; and
viii. the name of the person if it appears with other personal information relating to the person or if the
disclosure of the name itself would reveal information about the person.

6.  “ Processing” means any operation or activity or any set of operations whether or not by automatic
means, connected to personal information including –
(a) the collection, receipt, recording, organization, collation, storage, updating or modification, retrievable,
alteration, consultation or use;
(b) dissemination by means of transmission, distribution or making available in any other form; or
(c ) merging, linking, as well as restricting, degrading, erasure or deconstruction of information.
NOTE: POPI only covers the processing of personal information that is entered into a record by or on behalf of a
responsible party that is domiciled in South Africa, or, if not domiciled in South Africa, is using automated or non-
automated means that is situated in South Africa.
 “ Record” means any recorded information –
a) Regardless of the form or medium, including any of the following:
i. Writing on any material;
ii. Information produced, recorded or stored by means of any tape-recorder, computer equipment,
whether hardware or software of both, or other device, and any material subsequently derived fom
information so produced, recorded or stored;
iii. Label, marking or other writing that identifies or describes anything of which it forms part, or to which
it is attached by any means
iv. Book, map, plan, graph or drawing;
v. Photograph, film, negative, tape or other device in which one or more visual images are embodied so
as to be capable, with or without the aid of some other equipment, of being reproduced.

7. b) whether or not it was created by a responsible party; and
c) regardless of when it came into existence ( NB The retrospective provision in POPI)
 “ Electronic Communications” includes any text, voice, sound and imaged messages and includes the message
being stored prior to the recipient retrieving it. This would include social medium platforms such as Facebook, LinkedIn,
Twitter, etc in addition to e-mails, the Internet and the Intranet.
 “ Consent” for purposes of POPI means any voluntary, specific and informed expression of will in terms of which
permission is given for the processing of personal information.
NB
 It is important to note that “Consent” means specific consent . General consent will therefore not be sufficient and a
specific consent for each instance in which the personal information will be dealt with, must be obtained.
 The consent must have provided for exactly what personal information is required, why it is required, how it will be
dealt with, and where it will be stored.
 The consent must also provide for whether the personal information will be shared

8.  “ Data Subject” means the owner of the personal information (natural persons and/or juristic persons). In the
procurement context this will mean the bidding or contracting company or services provider, its owners, managers,
directors and employees.
 “ Information Officer” means the person appointed by the responsible party to manage the application of POPI.
 “Operator” means any person acting under a mandate or under contract of a responsible party who has a duty not to
disclose personal information. In the context of procurement this means any third party to whom procurement services has
been outsourced either in whole or in part. The operator must maintain the integrity and confidentiality of personal
information collected.
 “ Responsible Party” A private or public entity or any other person who determines the purpose of and the means for
processing personal information. In the procurement context, this would be the procuring entity often referred to as “The
Employer / The Purchaser” in procurement contracts.
 “Regulator” means the person to be appointed to implement and enforce the provisions of the POPI Act.

9. Conditions For Legal Processing of Personal Information
POPI sets out EIGHT (8) Conditions that must be complied with, namely –
1. Accountability (Section 8 of POPI)
2. Processing Limitation (Sections 9 - 12 of POPI)
3. Purpose Specification (Sections 13 – 14 of POPI)
4. Further Processing Limitation (Section 15 of POPI)
5. Information Quality (Section 16 of POPI)
6. Openness (Sections 17 – 18 of POPI)
7. Security Safeguards (Sections 19 – 22 of POPI)
8. Data Subject Participation (Sections 23 – 25 of POPI)

10. Impact of The POPI Act on the Procurement Process
• Minimally: RFX /vendor registration form must only request relevant personal information from
bidder/supplier, Personal information which is not relevant for bid evaluation or conclusion of a
contract with a supplier must not be collected.
• Consent, justification and objection: Record of consent and objections from bidder/supplier to
processing of personal information throughout the tendering process.
• Sources other than the data subject: Personal information (e.g. reference letter verification) that
The Employer / The Purchaser needs to obtain from a third party must be collected with prior
consent from the bidder/supplier.
Bid preparation
• Notification to data subject: The Employer / The Purchase must ensure that a bidder/supplier is
aware of the purpose the information is collected, as well as the consequences of failing to provide
the information.
• Bid documents submitted late must not be retained longer than necessary for the purpose collected
for.
• Integrity and confidentiality of personal information of late submitted bids must be maintained.
• Notification of security compromise to the Regulator and bidders in writing.
Issue, receipt & opening of bids

11. • Consent, justification and objection: Record of consent and objections from
bidder/supplier to processing of personal information.
• Sources other than the data subject: Verification or receiving of personal
information of supplier/bidder from third party must be done with prior consent from
bidder/supplier.
• Bid documents of unsuccessful bidders must not be retained longer than necessary
for the purpose collected for.
• Integrity and confidentiality of personal information of unsuccessful bidders.
• Notification of security compromise to the Regulator and bidders in writing.
Bid evaluation, Shortlisting & Adjudication

12. • Minimally: Personal information which is not relevant for conclusion of a
contract with a supplier must not be collected.
• The Employer / The Purchaser must put measures in place to prevent loss,
damage, unauthorised destruction and unauthorised access to personal
information of supplier/contractor.
• The Employer / The Purchaser must notify the Regulator and
supplier/contractor of the security compromise in writing.
Contract award & management
(general obligations)

13. • Contract between The Employer / The Purchaser and the operator must ensure
that the operator establishes and maintains security measures to safeguard
personal information being processed on behalf of The Employer / The
Purchaser.
• The operator must notify The Employer / The Purchaser immediately in an event
where there are reasonable grounds to believe personal information has been
accessed by an unauthorised person.
• The contract with an operator must ensure confidentiality of personal
information processed on behalf of The Employer / The Purchaser.
• A supply contract with an operator must include standard clauses outlining joint
responsibility in terms of the protection of personal information.
• The Employer / The Purchaser must have audit rights to conduct regular audits
on the operator’s security and confidentiality measures.
Contract award & management
(Supply Contract with an Operator)

14. Consequences Of Non-Compliance With The POPI Act
 FINE and/or IMPRISONMENT (not exceeding 10 Years)
 Any person who hinders, obstructs, or unlawfully influences the Regulator or any person acting at the direction of the
regulator;
 An employer who fails to comply with an enforcement notice;
 An employer who violates any conditions of processing of an account number.
 FINES
 Administrative Fines :
o The Regulator may issue an infringement notice in the event of an alleged contravention of the provisions of
POPI.
o The Regulator must specify the amount of the administrative fine which may not exceed ZAR 10 million.
o The Transgressor may within 30 days of receipt of the infringement notices
a) elect to pay the fine so determined by the Regulator, or
b) make instalment arrangements with the regulator to pay such fine as imposed, or
c) take the Regulator’s determination on review to the High Court.

15. Consequences Of Non-Compliance With The POPI Act
 Civil Damages
 The Data Subject may sue the Transgressor for damages or may request the Regulator to sue for damages.
 The principle of strict liability applies, meaning its not necessary for the Data Subject or the Regulator on behalf
of the Data Subject to prove intent or negligence.
 The amount of damages that may be awarded is punitive and far in excess of what can presently be awarded
under South African law.
i. The damages could include monetary and non-monetary loss;
ii. Aggravated damages,
iii. Interest and costs
 Fact that court order must be published in the Government Gazette and requirement that appropriate be
made can inflict great reputational damage on organizations.

16. THANK YOU
MYRON D. B. BETSHANGER
Corporate Governance, Legal & Regulatory Compliance Specialist
16 Verveen Street
Westenburg
Polokwane, South Africa
Mobile: +27 74 780 3862
e-mail: betshangermyron2@gmail.com
LinkedIn: https://za.linkedin.com/pub/myron-duncan-burton-betshanger/37/219/1b8
Twitter: @betshangermyron