What It Is

Protection of Personal Information Act, 2013 (Act 4 of 2013)—POPIA—is South Africa's comprehensive privacy statute. It regulates processing of personal information for natural and juristic persons via an accountability-based framework with eight conditions for lawful processing, overseen by the Information Regulator.

Key Components

• **Eight conditionsAccountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, data subject participation.
• Data subject rights (Sections 23–25, 71): Access, correction, objection, automated decision protections.
• **GovernanceMandatory Information Officer, operator contracts (Sections 20–21), breach notification (Section 22).
• No certification; compliance via Regulator enforcement, fines up to ZAR 10 million.

Why Organizations Use It

POPIA is legally mandatory for all processing in South Africa, including extraterritorial. It mitigates fines, imprisonment, civil claims; enhances trust, data hygiene; enables GDPR-aligned operations with local nuances like juristic persons.

Implementation Overview

Risk-based program: data mapping, Information Officer appointment, policies, security cycle (Section 19), rights workflows. Applies universally; phased approach (discovery, governance, controls) for all sizes, no certification but audits expected.

What It Is

ISO/IEC 27018:2025 is an international code of practice extending ISO 27001 and ISO 27002 to protect personally identifiable information (PII) processed by public cloud service providers acting as PII processors. It focuses on cloud-specific privacy risks like multi-tenancy, subprocessors, and cross-border transfers. The standard uses a risk-based approach, integrating ~25-30 privacy controls into an Information Security Management System (ISMS).

Key Components

• Additional privacy controls mapped to ISO 27001 Annex A (Organizational, People, Physical, Technological themes)
• Core principles: consent/choice, purpose limitation, data minimization, accuracy, transparency, accountability
• Assessed during ISO 27001 audits; no standalone certification

Why Organizations Use It

• Demonstrates processor diligence for GDPR/HIPAA alignment
• Accelerates procurement via transparent Statement of Applicability (SoA)
• Builds trust, reduces cyber insurance friction
• Enhances competitive differentiation for CSPs

Implementation Overview

• Gap analysis on existing ISMS, control integration
• Key activities: subprocessor disclosure, breach notification, data rights support
• Suited for CSPs all sizes/industries globally
• Third-party audits tied to ISO 27001 certification (annual surveillance)