Data, property, finance and security instruments · 01
Operator (data processing) agreement — POPIA section 21
The written contract POPIA requires wherever one organisation processes personal information on another’s behalf.
The written contract POPIA requires wherever one organisation processes personal information on another’s behalf.
A written contract is mandatory. It must record that the operator processes personal information only with the knowledge and authorisation of the responsible party and only on its documented instructions; the confidentiality obligation; the security safeguards required by section 19; the obligation to notify immediately where there are reasonable grounds to believe personal information has been accessed by an unauthorised person; sub-operator approval; cross-border transfer limits under section 72; assistance with data-subject requests; and return or deletion at the end.
Almost every organisation has operators it has never identified — the payroll bureau, the cloud host, the marketing agency, the shredding company, the IT support firm. The gap is rarely the clause; it is the register of who the operators are, so start there. And “notify without undue delay” is a weaker standard than the Act’s “immediately” — do not accept the softer wording off a supplier’s paper.
The law it sits under
What governs this instrument.
Section 21(1) of the Protection of Personal Information Act 4 of 2013 requires a written contract with any operator processing personal information on the responsible party’s behalf, obliging the operator to establish and maintain the security measures section 19 demands. Section 21(2) requires the operator to notify the responsible party immediately where there are reasonable grounds to believe personal information has been accessed by an unauthorised person, and section 22 then places the duty to notify the Regulator and the data subjects on the responsible party — not on the operator.
Related pages, tools and documents
Where this instrument sits in the wider set, and the engagement that produces it.
Start here
Tell us the decision your organisation needs to make.
The first conversation is thirty minutes, confidential and free. You will leave it knowing which of our services you need and which you do not.