The long-awaited draft South African Regulations Relating to the Protection of Personal Information, 2017 (the “draft Regulations”) were published today, 8 September 2017. 

Direct marketers have been speculating for years about the manner and form that the regulations will take under section 69(2) of the Protection of Personal Information Act, 2013 (“POPI”).

In terms of draft regulation 6, a responsible party may request a data subject’s written consent, by means of a form, to process their personal information, which corresponds substantially with form 4 to the draft Regulations. This form consists of two pages and will prove to be very onerous for any responsible party that conducts direct marketing by electronic means, such as email and SMS.

For a full copy of the draft Regulations, please click here. 

Government Gazette no. 41105, also published today, invites any person wishing to comment on the draft Regulations to submit these to the Information Regulator on or before 7 November 2017. In addition, insurance companies, medical schemes, medical scheme administrators, managed healthcare organisations, administrative bodies, pension funds, “employers”, “institutions working for them” and other interested parties are invited to submit their comments in relation to the detailed rules that will apply to the processing of personal information concerning a data subject’s health, pursuant to section 32(6) and 32(1)(b) and (f) of POPI.