Notice and Privacy Policy

Under POPIA, the data controller must inform the data subject, before the information is collected, and unless the data subject is already aware of the information, of the following:

  • the information being collected, and where the information is not collected from the data subject, the source from which it is collected;
  • the name and address of the data controller;
  • the purpose for which the information is being collected;
  • whether or not the supply of the information by that data subject is voluntary or mandatory;
  • the consequences of failure to provide the information;
  • any particular law authorising or requiring the collection of the information;
  • the fact that, where applicable, the data controller intends to transfer the information to a third country or international organisation and the level of protection afforded to the information by that third country or international organisation;
  • any further information necessary such as:
    • the recipient or category of recipients of the information;
    • the nature or category of the information;
    • the existence of the right of access to and the right to rectify the information collected;
    • the existence of the right to object to the processing of personal information; and
    • the right to lodge a complaint to the Information Regulator and the contact details of the Information Regulator.


If the information is not collected directly from the data subject the information above must be provided before the data is collected or as soon as reasonably practicable after it has been collected.

There is no requirement to inform if:

  • the data subject (or a competent person where the data subject is a child) has provided consent;
  • non-compliance would not prejudice the legitimate interests of the data subject;
  • data processing is necessary:
    • to avoid prejudice to the maintenance of the law by any public body;
    • to comply with requirements imposed by law, or to enforce legislation concerning the collection of revenue;
    • to ensure the proceedings in any court or tribunal that have been commenced or are reasonably contemplated; or
    • in the interests of national security;
  • compliance would prejudice a lawful purpose of the collection;
  • compliance is not reasonably practicable in the circumstances of the particular case; or
  • the information will not be used in a form in which the data subject may be identified; or
  • the information will be used for historical, statistical or research purposes.