POPI Act Compliance Document

POPI ACT COMPLIANCE DOCUMENT

This POPI Act Compliance Agreement (the "Agreement") is entered into as of by and between Client Name: , a legal entity with registration number: and principal address: (hereinafter "Data Controller"), and Service Provider Name: , a legal entity with registration number: and principal address: (hereinafter "Data Processor").

RECITALS

WHEREAS, the Data Controller collects, stores and processes personal information in the course of its business operations and is subject to the Protection of Personal Information Act and related regulations (collectively, the "POPI Act");

WHEREAS, the Data Processor provides services which require access to, or the processing of, personal information on behalf of the Data Controller and represents that it will process such information only on documented instructions consistent with the POPI Act; and

WHEREAS, the parties wish to set forth the terms, security measures and obligations necessary to ensure lawful processing, protection and breach management of personal information.

NOW THEREFORE, in consideration of the mutual covenants herein, the parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement, the following definitions apply: "Personal Information" means any information relating to an identifiable natural person; "Processing" means any operation performed on Personal Information including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure or destruction; "Subprocessor" means any third party engaged by the Data Processor to carry out processing activities on behalf of the Data Controller.

2. PURPOSE AND SCOPE

2.1 The Data Processor shall process Personal Information only for the documented purposes and activities described below and only to the extent necessary to perform the services specified by the Data Controller.

3. CATEGORIES OF PERSONAL INFORMATION

The Data Processor will have access to the following categories of Personal Information (check all that apply and describe "Other" if applicable):

Contact information (name, telephone, email)
Identifiers (ID number, passport, employee number)
Financial information (bank details, payment records)
Special personal information (health, biometric) where applicable
Other

4. OBLIGATIONS OF THE DATA CONTROLLER

The Data Controller shall: (a) provide documented instructions to the Data Processor for processing activities; (b) ensure that it has a lawful basis under the POPI Act for the processing activities; (c) maintain records of authorizations and consents where required; and (d) notify the Data Processor promptly of any restriction on processing, data subject requests or regulatory inquiries that affect processing under this Agreement.

5. OBLIGATIONS OF THE DATA PROCESSOR

The Data Processor shall: (a) process Personal Information only on documented instructions from the Data Controller; (b) implement and maintain appropriate technical and organisational measures to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access; (c) ensure persons authorised to process Personal Information are subject to confidentiality obligations; and (d) assist the Data Controller in responding to data subject requests and fulfilling obligations under the POPI Act.

6. SECURITY MEASURES

The Data Processor represents that it has implemented, and will maintain, technical and organisational measures appropriate to the risks involved, including but not limited to:

Encryption of data at rest and in transit
Role-based access controls and authentication
Audit logging and monitoring
Secure backups and disaster recovery procedures
Security awareness training for personnel

7. DATA SUBJECT RIGHTS AND ASSISTANCE

The Data Processor shall, to the extent legally permissible and subject to the Data Controller's instructions, promptly assist the Data Controller in responding to requests from data subjects to exercise their rights under the POPI Act, including access, correction, erasure, restriction and objection. The Data Processor will notify the Data Controller without undue delay upon receipt of any such request.

8. BREACH NOTIFICATION

In the event of a confirmed or suspected security breach affecting Personal Information, the Data Processor shall notify the Data Controller without undue delay and, where feasible, within . The notification will include the nature of the breach, categories and approximate number of data subjects affected, measures taken and recommended remediation steps. The Data Processor will cooperate with the Data Controller and regulators in any investigation and mitigation.

9. RETENTION, RETURN AND DESTRUCTION

The Data Processor shall retain Personal Information only for the period necessary to fulfil the documented processing purposes, after which it shall, at the election of the Data Controller, return or securely destroy the data and certify such destruction. Agreed retention period: .

10. SUBPROCESSORS AND CROSS-BORDER TRANSFERS

The Data Processor shall not engage any Subprocessor without prior written authorization from the Data Controller. The Data Processor shall impose obligations on Subprocessors no less protective than those set forth in this Agreement. Any cross-border transfer of Personal Information shall be subject to appropriate safeguards compliant with the POPI Act and any applicable regulations; details of intended transfers and safeguards must be provided to the Data Controller in advance.

11. AUDIT, RECORDS AND COMPLIANCE

The Data Processor shall maintain records of processing activities and information sufficient to demonstrate compliance with this Agreement and the POPI Act. The Data Controller, or an independent auditor on its behalf, may, upon reasonable notice and subject to confidentiality protections, audit the Data Processor's relevant policies, procedures and facilities to verify compliance. The Data Processor shall remediate any deficiencies identified in a timely manner.

12. INDEMNITY, LIMITATION OF LIABILITY AND MISCELLANEOUS

12.1 The Data Processor shall indemnify and hold harmless the Data Controller from losses arising from the Processor's breach of this Agreement or non-compliance with the POPI Act, except to the extent caused by the Controller's breach or instructions.
12.2 Neither party excludes liability for fraud, wilful misconduct or any liability which cannot be limited by law. Except for such liabilities, each party's aggregate liability arising out of or in connection with this Agreement shall be limited to the value of fees paid under the parties' underlying services agreement during the twelve (12) months preceding the claim.
12.3 Governing Law: This Agreement shall be governed by and construed in accordance with the laws applicable to the POPI Act.
12.4 Entire Agreement: This Agreement, together with any referenced attachments and the parties' underlying services agreement, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior agreements and understandings.
12.5 Severability: If any provision of this Agreement is held invalid or unenforceable, the remainder of the Agreement shall continue in full force and effect.
12.6 Notices: All notices under this Agreement must be in writing and delivered to the addresses specified below. Notices are deemed given when delivered in person, by registered mail, or by courier service.
12.7 Amendments and Waiver: Any amendment to this Agreement must be in writing and signed by both parties. Failure to enforce any provision is not a waiver of future enforcement rights.
12.8 Counterparts: This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

NOTICES

CERTIFICATIONS

Each party certifies that it has the authority to enter into this Agreement and that the information provided herein is accurate. The Data Processor certifies that it has implemented the measures described above and will maintain appropriate procedures to ensure compliance with the POPI Act and this Agreement.

Sign Now