0861 IRON MTN (476 668)

Protection of Personal Information Act (PoPI Act)

Protection of Personal Information Act compliance through Iron Mountain

The Protection of Personal Information Act was gazetted on the 26th November 2013 bringing with it major improvements to that way South African’s personal data is collected and processed. South Africans now have a legal basis to enforce their constitutional right to  privacy by holding unscrupulous or careless organisations responsible for information abuse. This stride forward in protection applies to both individuals and juristic persons so all companies are protected as well.

Unfortunately, the improvements require a number of changes to the way we collect, process and store both personal and company information as there are stiff penalties (up to 10 years imprisonment) for non-compliance. Consult your legal advisor for further information however here are some Protection of Personal Information Act (PoPI Act) document destruction considerations to get you started:

– The definition of personal information covers everything from a name and telephone number on a piece of scrap paper to a company order/invoice or statement. Most documents we print and casually discard each day contain personal information.

– Personal info (e.g. paper records) can no longer be stored for longer than legally or practically necessary. This means that storing 10 years’ worth of data relating to individuals and/or companies (e.g. Debtors/Creditors data) is no longer legal.

– Personal information must be destroyed or deleted as soon as reasonably practical after it has served the purpose for which it was collected. Such destruction should be done in a manner that prevents its reconstruction in an intelligible form. (e.g. Shredding)

– Personal information needs to be secured so as to prevent unauthorised access. (e.g Secure Shredding Bins). Companies need to show they identified all reasonably foreseeable internal and external risks to personal info under their control.

– Companies now needs to keep a full record (e.g. Shredding Certificate) of all personal information processing including destruction.

Fortunately Iron Mountain’s services have been carefully designed with the PoPI Act in mind. Our contracted services ensure that all security and safety concerns are addressed and that our customers have a cost effective,  efficient and legally compliant solution in place to deal with all paper based information.


Contact Iron Mountain