Overview

The POPI Act specifies that personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party. The responsible party must take steps to ensure that data subjects are aware of the purpose of the collection of the information unless they are already aware of the purpose for processing their personal information.

The PAIA manual and privacy notices on forms, contacts and web pages are some of the ways data subjects are made aware. Over time the nature of processing changes. Version control over privacy notices is necessary and a lg of changes retained. The POPIA platform provides a repository of privacy notices, with version control, and details of placement in business processes and communications with data subjects. 

The documentation of processing operations will support the preparation of the PAIA manual.