POPI Act: The Protection of Personal Information Act
The purpose of the Act is to protect personal information, to strike a balance between the right to privacy and the need for the free flow of, and access to, information, and to regulate how personal information is processed.
What you need to know: POPI provides the following additional protections:
- The applicant must be informed that his or her personal information is being collected.
- The applicant must consent to the processing of his or her personal information.
This is the one to note: the record of personal information may not be kept for longer than necessary for achieving the purpose for which the information was collected (in this case, the screening of job applicants). This means that you can no longer “just submit” your CV to agencies or clients and expect them to keep it on record, should they not have a current suitable position.
The POPIA data lifecycle (Create → Store → Use → Archive → Destroy) is governed by eight conditions for lawful processing: accountability, processing limitation, specified purpose, limitation on further processing, information quality, openness, security safeguards, and participation of the data subject.
