Protection of Personal Information (POPIA) & the Right to Access to Information (PAIA)

Disclaimer & Website Terms of Use


Section 18 Notification

Transparency about which information is being collected, who collects and gets access to the information, and for what purpose it will be used, is one of the most important principles of POPIA compliance.

In fact, an entire section of POPIA is devoted to the notification obligation: Section 18. If personal information is collected, the responsible party must take reasonably practicable steps to ensure that the data subject is aware of—

(a) the information being collected and where the information is not collected from the data subject, the source from which it is collected;
(b) the name and address of the responsible party;
(c) the purpose for which the information is being collected;
(d) whether or not the supply of the information by that data subject is voluntary or mandatory;
(e) the consequences of failure to provide the information;
(f) any particular law authorising or requiring the collection of the information;
(g) the fact that, where applicable, the responsible party intends to transfer the information to a third country or international organisation and the level of protection afforded to the information by that third country or international organisation;
(h) any further information such as the—
(i) recipient or category of recipients of the information;
(ii) nature or category of the information;
(iii) existence of the right of access to and the right to rectify the information collected;
(iv) existence of the right to object to the processing of personal information as referred to in section 11(3); and
(v) right to lodge a complaint to the Information Regulator and the contact details of the Information Regulator.

A section 18 notification must be displayed before the information is collected if the personal information is collected directly from the data subject, or else as soon as reasonably practicable after it has been collected.