By and large, the Protection of Personal Information Act, 2013
(“POPIA”) only imposes obligations,
duties and liabilities on the responsible party. A responsible
party is defined in POPIA as “a public or private body or any
other person which, alone or in conjunction with others, determines
the purpose of and means for processing personal
information”.
For example, in terms of POPIA, it is the responsible party who
bears the onus and obligation to report any security compromise or
data breach to the Information Regulator and affected data
subjects. Ultimately, it is the responsible party who is liable to
data subjects for civil claims for damages and/or to the
Information Regulator for enforcement action in the event that it
fails to comply with POPIA.
