The Protection of Personal Information Act (POPIA) is a legal document which regulates the processing of personal information of an individual (also called a “data subject”) by those responsible parties (such as employers and institutions) who have access to key pieces of information that are commonly stored by them, such as: employee records, customer details, loyalty schemes, transactions, etc. which need to be protected. The purpose of Act is to strike a balance between the right to privacy and the need for the free flow of, and access to information, and to regulate how personal information is processed.
Essentially what this means is that anything that what an employer can and does do with personal information that belongs to an employee (be it collecting information, storing or disseminating / destroying that information) must be done in line with the information detailed within the Act.
In the workplace, any personal information of an individual must be protected from being shared with anyone who does not have permission to have or use that information.
The POPI Act helps stop personal information from being accessed by those who do not have the right to access it. It controls the way personal information is used, shared, who it is shared with and why it is shared. Personal information includes any information about a person that helps to identify that person and it applies to everyone, all the time! If an organisation collects any employee information (which it does) POPIA applies, no matter the size of the organisation.
Personal Information can include race, gender, sex, marital status, nationality, ethnicity, sexual orientation, physical or mental health, disability, religion, culture, language, education, and medical information. It also refers to your cell phone number, email address, home address and even what you do in your private time, who your family are and who you might be dating or in a relationship with. All these things are your personal information and if there is no valid reason for people to have this information (by this we mean the reason must be LEGAL and REQUIRED for the workplace to operate) then this personal information may not be shared with another person without first getting your consent.
An example of this is, at work, the company needs your banking details to make sure that you get paid every month. They also need your personal information for record-keeping purposes. These are legal and required reasons to have your personal information. If you have access to someone else’s personal information, it is not yours to share unless there is a valid reason why you need to share this information.
In the same way that you would not want someone sharing your banking details with another person, personal information of any kind may not be shared with those who do not need to have access to it.
If you share personal information of others without a legal or valid reason can lead to disciplinary action.
