Existing GDPR policies and documents can readily be adapted for
POPIA compliance and vice versa. In this article, we
briefly detail the general application of the EU General Data
Protection Regulation 2016/679 ("GDPR")
and the Protection of Personal Information Act, 2013
("POPIA").
GDPR
Article 3(1) of the GDPR provides that the GDPR applies to the
processing of personal data in the context of the activities of an
establishment of a controller or a processor in the EU, regardless
of whether the processing takes place in the EU or not.
In Article 3(2) the GDPR sets out its extraterritorial scope and
provides:
"This Regulation applies to the processing of personal data
of data subjects who are in the Union by a controller or processor
not established in the Union, where the processing activities are
related to:
