News From Africa  

Will SA be influenced by India’s New Bill on Data Privacy? And a Reminder About The PAIA/POPIA Requirements

The Indian government has presented a new Bill to Parliament on ‘Digital Personal Data Protection’. This will bring together various other pieces of legislation. Of particular interest is that India proposes to back-track on its previous ‘data localisation’ approach. Data localisation requires that any data generated in a country must remain in that country. It also often considers how privately owned data should be used to benefit the public interest. The SA DCDT proposed a similar policy for SA in 2020, entitled ‘A Draft Data and Cloud Policy’ – see previous Newsletters. The DCDT is presently considering how to progress with its Draft Plan. Hopefully, the turnabout by India will persuade the Department to abandon its plans. India will carry on with its restrictions to localise financial data (SARB imposes similar rules on the SA financial sector).

The Promotion of Access to Information Act (PAIA) allows for anyone to submit a request for information held by certain bodies, to be made available via a PAIA request form. These bodies include all businesses, from sole proprietors to private companies and listed multinationals. Private bodies were previously exempt from PAIA compliance, but this changed on 31 December 2021. It’s now very likely that PAIA compliance will apply to you, and your company should take action.

Meanwhile, last month the Nigerian Data Protection Board released the Data Protection Bill 2022. The Bill appears to be a beacon of hope for a final legislation on the subject, as the NDPB National Commissioner had promised earlier in the year that there would be a Data Protection Act by December 2022.