As soon as you get near information about a person, it is safe to assume that you are “processing” it. Or for those who prefer more formal definitions: processing is any operation or activity or any set of operations, concerning personal information, whether digital or physical, automatic or manual.
POPIA, in other words, applies to the ‘full life-cycle’ of personal information: from its creation, collection, storage, usage, transfer and amendment to its destruction.
POPIA supports the concept of ‘privacy by design’ – data processors need to respect privacy from the very first step in the life-cycle of personal information, to the very last.
Processing means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including—