white_paper_on_data_protection_in_india_171127_final_v2

scope of the processing activity, as well as the risks posed to the individual by processing her
personal information. 681 Risks could include physical, material, or non-material damage.
Non-material damage could include: discrimination, fraud, and reputational damage.
In order to demonstrate that a data controller has complied with its obligations under the EU
GDPR, it could implement internal data protection policies; maintain relevant documentation
of processing activities; and use data protection impact assessments where appropriate. 682
South Africa
The POPI Act sets out that a ―responsible party‖ must ensure that certain conditions for
lawful processing of personal data are satisfied at the time of processing. 683 The conditions
for lawful processing of personal data are: accountability 684 , processing limitation 685 , purpose
specification 686 , further processing limitation, 687 information quality, 688 openness, 689 security
safeguards, 690 and data subject participation. 691
As part of the accountability principle, a responsible party must ensure that it secures the
integrity and confidentiality of personal information in its possession by taking appropriate
and reasonable technical and organisational measures in order to prevent loss, damage, or
unauthorised destruction of personal information. The responsible party must also prevent
unlawful access to, and unlawful processing of personal information. 692
In order to ensure this, the POPI Act provides that a responsible party must take reasonable
measures to identify all reasonably foreseeable internal and external risks to the personal
information in its control, establish and maintain appropriate safeguards against these
identified risks, verify that these safeguards are implemented and also to ensure that the
safeguards are updated in order to respond to any new risks or to plug-in deficiencies found in
the previous safeguard measures. 693
The POPI Act has an additional obligation on third parties that process personal data on
behalf of a responsible party. It provides that such third parties may process personal data
only with the knowledge or authorisation of the responsible party and must treat personal
information as confidential. 694 Additionally, the POPI Act provides that where an operator (a
681 Article 25, EU GDPR, read with Recitals 74 and 75 of the EU GDPR.
682 ICO, ‗Accountability and Governance‘, available at: https://ico.org.uk/for-organisations/data-protectionreform/overview-of-the-gdpr/accountability-and-governance/,
(last accessed 20 November 2017).
683 Section 8, POPI Act.
684 Section 8, POPI Act.
685 Sections 9, 10, 11 and 12, POPI Act.
686 Sections 13 and 14, POPI Act.
687 Section 15, POPI Act.
688 Section 16, POPI Act.
689 Sections 17 and 18, POPI Act.
690 Sections 19, 20, 21 and 22, POPI Act.
691 Sections 23, 24 and 25, POPI Act.
692 Sections 19(1)(a) and (b), POPI Act.
693 Section 19(2), POPI Act.
694 Section 20, POPI Act.
152