Drafting a Code of Conduct for Research under the Protection of Personal Information Act No. 4 of 2013

Abstract

On 22 June 2020, President Ramaphosa announced that the Protection of Personal Information Act No. 4 of 2013 (POPIA) would come into effect on 1 July 2020. A one-year grace period was provided to give organisations time to comply with the provisions of the Act. It will therefore be mandatory as of 1 July 2021, for all sectors in South Africa to comply with POPIA. POPIA gives effect to the constitutional right to privacy. In so doing, it balances the right to privacy with other rights and interests, including the free flow of information within South Africa and across its borders. POPIA adopts a principle-based approach to the processing of personal information. It sets out eight conditions for the lawful processing of personal information: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. These principles apply equally to all sectors that process personal information.