Material Applicability

The Protection of Personal Information Act establishes three key material applicability factors:

• Filing System Criterion
• Prospective Filing System Inclusion
• Government and Public Agency Exemption

Filing System and Prospective Filing System Requirements

POPIA Art.3(1)(a):

"This Act applies to the processing of personal information entered in a record by or for a responsible party by making use of automated or non-automated means: Provided that when the recorded personal information is processed by non-automated means, it forms part of a filing system or is intended to form part thereof"

The Act applies to both automated and non-automated processing of personal information. For non-automated processing, the data must either be:

• Part of an existing filing system
• Intended to be included in a filing system

Public Bodies Processing

POPIA Art.3(3)(b):

"This Act must be interpreted in a manner that does not prevent any public or private body from exercising or performing its powers, duties and functions in terms of the law as far as such powers, duties and functions relate to the processing of personal information"

Unlike some jurisdictions, POPIA does not provide broad exemptions for government agencies. Instead, it ensures public bodies can perform their functions while remaining subject to the Act's requirements.

Territorial Applicability

POPIA's territorial scope is determined by three main factors:

• Entity's Link or Presence in Jurisdiction
• Processing by Entity Registered or Incorporated in Jurisdiction
• Use of Equipment Within Jurisdiction

Domicile and Registration

POPIA Art.3(1)(b)(i):

"This Act applies to the processing of personal information where the responsible party is domiciled in the Republic"

The Act applies to all responsible parties domiciled in South Africa, regardless of where the processing occurs.

Use of Means Within South Africa

POPIA Art.3(1)(b)(ii):

"where the responsible party is not domiciled in the Republic, but makes use of automated or non-automated means in the Republic, unless those means are used only to forward personal information through the Republic"

The Act extends to non-domiciled entities that:

• Use processing means located in South Africa
• Exception: When means are used solely for data transit