POPIA — POPIA Code of Conduct: Code of Conduct for the Credit Bureau Association (CBA) (source: https://inforegulator.org.za/wp-content/uploads/2022/10/Code%20of%20Conduct%20for%20the%20Credit%20Bureau%20Associaltion%20(CBA).pdf)
Code of Conduct governing the Conditions for Lawful Processing of Personal Information
by members of the Credit Bureau Association, South Africa.
Issued in terms of Section 60 of the Protection of Personal Information Act, No. 4 of 2013
(“PoPIA”) by the Information Regulator
CODE OF CONDUCT
Lawful Processing of Personal Information by credit bureaus in South Africa
THE CREDIT BUREAU ASSOCIATION, SOUTH AFRICA
CBA CODE OF CONDUCT 15.09.2021.DOCX
Table of Contents
PART A – INTRODUCTION ..................................................................................................................................1
1. MANDATE AND APPLICATION ..........................................................................................................1
2. PURPOSE .............................................................................................................................................1
3. SCOPE ..................................................................................................................................................1
4. DEFINITIONS AND ABBREVIATIONS ................................................................................................2
5. COMMENCEMENT OF THE CODE .....................................................................................................2
PART B – CONDITIONS FOR LAWFUL PROCESSING OF PERSONAL INFORMATION ...............................3
1. GENERAL .............................................................................................................................................3
2. CONDITION 1: ACCOUNTABILITY .....................................................................................................4
3. CONDITION 2: PROCESSING LIMITATION .......................................................................................5
4. CONDITION 3: PURPOSE SPECIFICATION .......................................................................................7
5. CONDITION 4: FURTHER PROCESSING LIMITATION .....................................................................8
6. CONDITION 5: INFORMATION QUALITY ...........................................................................................9
7. CONDITION 6: OPENNESS ...............................................................................................................10
8. CONDITION 7: SECURITY SAFEGUARDS .......................................................................................12
9. CONDITION 8 : DATA SUBJECT PARTICIPATION .........................................................................14
10. PROCESSING OF SPECIAL PERSONAL INFORMATION ..............................................................16
11. PROCESSING OF PERSONAL INFORMATION OF CHILDREN .....................................................17
PART C – ENFORCEMENT ...............................................................................................................................18
1. INTERPRETATION .............................................................................................................................18
2. RIGHTS UNDER THE NCA AND POPIA ...........................................................................................18
3. COMPLAINTS PROCESS ..................................................................................................................18
4. INTERPRETATION AND DISPUTES RELATING TO THE CODE BY CBA MEMBERS .................20
5. INDEPENDENT ADJUDICATOR ........................................................................................................21
6. QUALIFICATIONS AND CRITERIA FOR INDEPENDENT ADJUDICATORS ..................................21
7. APPOINTMENT AND POWERS OF ADJUDICATOR .......................................................................22
8. REPORTS TO REGULATOR .............................................................................................................23
PART D – ADMINISTRATION OF CODE OF CONDUCT .................................................................................24
1. COMPLIANCE WITH CHAPTER 7 OF POPIA ..................................................................................24
ATTACHMENT: CBA Member PoPIA Compliance Monitoring plan
CBA CODE OF CONDUCT 15.09.2021.DOCX
PART A – INTRODUCTION
1. MANDATE AND APPLICATION
1.1 The Credit Bureau Association, South Africa (“CBA”) is a voluntary association of credit bureaus,
whose members process the vast majority of consumer credit information relied upon by the credit
industry in South Africa.
1.2 Credit bureaus are duly registered in terms of Section 43(1) of the National Credit Act, 34 of 2005 and
the Regulations thereto (as amended) (“NCA”), and governed by the National Credit Regulator
(“NCR”).
1.3 All CBA members are bound by the CBA Constitution to process consumer credit information in a
manner that promotes confidentiality, accuracy, and relevancy in accordance with international best
practice and relevant legislation.
1.4 The Protection of Personal Information Act, 4 of 2013 (“PoPIA”) stipulates as among its primary
purposes; giving effect to the constitutional right to privacy, the establishment of the way personal
information may be processed by prescribing minimum threshold requirements for the lawful
processing of personal information and providing remedies to persons whose personal information is
not processed in accordance with PoPIA.
1.5 In addition to the conditions governing the lawful processing of personal information stipulated in
PoPIA, credit bureaus are also subject to the restrictions contained in Section 70 of the NCA, read with
Section 18 of the NCA Regulations, which governs the processing of consumer credit information.
1.6 All members of the CBA are statutorily obliged to process credit information and to comply with the
conditions for the lawful Processing of Personal Information as set out in PoPIA. All members of the
CBA adopt this Code of Conduct and will apply its principles to the processing of consumer credit
information and personal information.
2. PURPOSE
The purpose of this Code of Conduct is to set out specific data processing rules and standardised
procedures to guarantee, at a credit bureau industry level and having regard for the legal obligations under
PoPIA, the NCA and other laws or practices governing the processing of personal information, the effective,
consistent and homogeneous application of PoPIA, while also guaranteeing that the interests of the parties
involved in the processing of personal data are properly balanced.
3. SCOPE
This Code of Conduct applies to :
3.1 the processing of personal information (including consumer credit information) belonging to data
subjects (natural and juristic) by registered credit bureaus that are members of the CBA,
CBA CODE OF CONDUCT 15.09.2021.DOCX
3.2 the enforcement by the CBA of the provisions of this Code of Conduct.
4. DEFINITIONS AND ABBREVIATIONS
Unless stated otherwise, the definitions as set out in PoPIA and the NCA will apply.
5. COMMENCEMENT OF THE CODE
5.1 This Code will come into force and be binding on every member of the CBA on the 28 th day after
notification of its issue by the Regulator in the Gazette as required in section 62(2) of PoPIA
(“commencement date”).
5.2 Unless revoked by the Regulator, the Code will terminate on the last day before the 5th anniversary of
the commencement date (“termination date”), prior to which time, the CBA may apply to the Information
Regulator for the issue of a revised or new Code of Conduct.
5.3 The Regulator may review the operation of the Code and if necessary, require amendment or revoke
the Code with immediate effect or at a future date to be determined by the Regulator.
5.4 The CBA will publish the commencement and termination date of this Code of Conduct on its website,
which notice will be displayed in a manner that it is associated with the Code of Conduct.
CBA CODE OF CONDUCT 15.09.2021.DOCX
PART B – CONDITIONS FOR LAWFUL PROCESSING OF PERSONAL INFORMATION
GENERAL
a) In applying the conditions for the lawful processing of personal information the separate conditions must
not be considered in isolation. They should be regarded as a constellation of conditions that interact with
and may influence the interpretation, and application of the other conditions as circumstances may dictate.
b) Credit bureaus and other members of the credit industry are subject to governance and regulation
stipulated in terms of the NCA. The NCA expressly deals with “consumer credit information” (defined in
Section 70) and with “confidential information”, and defines these terms to mean “Personal information
that belongs to a person and is not generally available to or known by others”. Both “consumer credit
information” and “confidential information” as used in the NCA fall within the definition of “personal
information” in PoPIA.
c) While the general principles of processing personal information stipulated in PoPIA apply to all personal
information, the NCA governs the filing of consumer credit information, and specifically states that credit
bureaus must accept the filing of consumer credit information, take reasonable steps to verify the accuracy
of information, retain the information for the prescribed period, promptly delete the information once it is
no longer permitted to retain it anymore and furthermore release the information if someone requires it as
set out in the NCA (see section 70(2) of the NCA).
d) Therefore, while the provisions governing the processing of information in the NCA, are not in all aspects
as detailed and as extensive as PoPIA, they are not inconsistent with PoPIA. Credit bureaus operating in
accordance with the NCA, already largely comply with the conditions for the lawful processing of personal
information contained in PoPIA.
e) In consequence of their compliance with the NCA, credit bureaus, in many instances, have developed
practices that comply with the conditions for the lawful processing of personal information or practices that
constitute functional equivalence of what is required in these conditions.
f) The practical application of the principles for the processing of personal information by credit bureaus are
described in addressing each of the conditions as hereinafter more fully described.
CBA CODE OF CONDUCT 15.09.2021.DOCX
1. CONDITION 1: ACCOUNTABILITY1
Due to their regulatory obligations under the NCA, credit bureaus will in most cases act as a responsible
party, specifically when a credit bureau receives and loads information in order to perform its obligations as
mandated by law. When acting as a responsible party, the bureaus must ensure that all 8 conditions for
lawful processing and the measures that give effect to such conditions, are complied with at the time of the
determination of the purpose and means of the processing, as well as during the processing itself.
1.1 To ensure that credit bureaus comply with the accountability condition when acting as a responsible
party, credit bureaus have established a governance framework to ensure strategic, governance
and execution oversight of all privacy-related matters that:
1.1.1 necessitates the appointment and registration of an Information Officer (and where
applicable a deputy Information Officer) with the Information Regulator;
1.1.2 assigns responsibility for the protection of personal information throughout the business;
1.1.3 requires effective communication between the Information Officer, data subjects and the
business;
1.1.4 requires that all PoPIA compliance activities and controls are documented and
demonstrable for verification or audit purposes, this includes the development and
maintenance of policies that set out PoPIA requirements, and procedures that incorporate
appropriate controls;
1.1.5 requires the performance of a personal information impact assessments (“PIIA”), that
ensure that adequate measures and standards exist in order to comply with the conditions
for the lawful processing;
1.1.6 requires the bureau to maintain an inventory of processing activities, that demonstrates that
processing activities involving personal information comply with PoPIA;
1.1.7 requires the implementation of training programmes that will ensure that those persons
responsible for the credit bureau complying with its obligations in terms of PoPIA are
appropriately trained.
1.2 Where credit bureaus act as operator for a client, the bureau will require the client to only instruct
the bureau to process information where the client has a lawful ground for processing. Where the
processing is conducted in accordance with section 70 of the NCA, the lawful ground for processing
will be section 11(c) of PoPIA. Credit bureaus will: i) maintain strong security controls for any data
processing activity; ii) maintain an updated record of all processing activities carried out as an
Operator; iii) notify the Responsible Party as soon as a breach of Personal Information is
discovered; and iv) ensure that a legally binding contract with Responsible Party is in place.
1 Section 8 Responsible party to ensure conditions for lawful processing, PoPIA
CBA CODE OF CONDUCT 15.09.2021.DOCX
2. CONDITION 2: PROCESSING LIMITATION
Lawfulness of processing2
2.1. When acting as a responsible party, credit bureaus ensure personal information is processed
lawfully and in a reasonable manner that does not infringe the privacy of data subjects. In order to
facilitate such processing, bureaus implement and maintain a data privacy policy requiring the lawful
processing of personal information, as provided for in PoPIA and elaborated further in this code of
conduct.
2.2. The data privacy policy ensures that all processing of personal information is reasonable, necessary
and does not infringe on the data subjects right to privacy.
Minimality3
2.3. Credit bureaus will only process Personal Information if, given the purpose for which the information
is processed, the categories and volumes of Information are adequate, relevant and not excessive.
2.4. In order to ensure that the minimum amount of processing of personal information is processed to
achieve a specified purpose, bureaus implement and maintain appropriate control measures to
ensure that their products only require and return minimal Information required for the
predetermined purpose of processing.
2.5. Credit bureau systems which facilitate the processing of large volumes of Personal Information,
ensure that only the necessary information is processed to achieve the stated purposes and the
systems and information are securely maintained. A PIIA is conducted to ensure the minimum
amount of personal information necessary to achieve the specified purpose(s) is processed.
Consent, justification, and objection4
2.6 Credit bureaus only process Personal Information based on one of the acceptable grounds for
lawful processing, which are identified and documented by the credit bureau prior to the
commencement of the contemplated processing activity. The lawful grounds and justifications for
processing in terms of the PoPIA which may be relied upon by credit bureaus include:
2.6.1 the data subject provides explicit consent for the processing of their Personal Information
for specified purpose(s); or
2.6.2 processing is necessary to carry out actions for the conclusion or performance of a contract
to which the data subject is party; or
2.6.3 processing to protect a legitimate interest of the Data subject; or
Section 9 lawfulness of processing, PoPIA
Section 10 minimality, PoPIA
Section 11 consent, justification and objection, PoPIA
CBA CODE OF CONDUCT 15.09.2021.DOCX
2.6.4 processing which is necessary to comply with an obligation imposed by law; or
2.6.5 processing is necessary for pursuing the legitimate interests of the responsible party (or of
a third party), such as in the instance of a credit worthiness assessment for juristic persons.
2.7 Where credit bureaus rely on consent for the lawful processing of Personal Information, the consent
complies with the following provisions:
2.7.1 the credit bureaus ensure that such consent is for a specific purpose, freely given, and
requires a clear expression of will by the data subject;
2.7.2 the data subject is notified at the time of consent collection how consent can be withdrawn
in a clear, concise and understandable manner;
2.7.3 where consent specifically relates to direct marketing by electronic communication, that the
consent is requested in manner and form prescribed in PoPIA regulation 6, read with form
4;
2.7.4 the credit bureau adequately records such consent so it can demonstrate the explicit
consent, and when such consent was received for the processing on request.
2.8 Where processing of personal information by credit bureaus is conducted in accordance with the
NCA, its processing is necessary to comply with an obligation imposed by law on the responsible
party.
2.8.1 The NCA stipulates the manner of processing personal information in so far as it applies to
a consumer. Therefore, credit bureaus process consumer credit information in the course
and scope of their activities and limits the collection of Personal Information to include only
what is permitted and which is necessary to maintain data quality and accuracy and to
enable its clients to make meaningful and accurate decisions;
2.8.2 The credit bureaus will report or release consumer credit information as directed or
permitted by the NCA. The bureaus are obligated to release consumer credit information
to any person who requires it for a prescribed or contemplated purpose; and to other credit
bureaus, as required and permitted in terms of the NCA.
2.9 Where credit bureaus rely on the processing of personal information in terms of a legitimate interest,
the credit bureaus will:
2.9.1 determine the applicable legitimate interest;
2.9.2 determine whether the interest entails the protection of a legitimate interest of the data
subject, or is necessary for pursuing the legitimate interest of the responsible party, or a
third party to whom the personal information will be supplied;
2.9.3 carefully assess whether a data subject can reasonably expect, at the time of collection of
the personal information, that processing for that purpose may take place;
CBA CODE OF CONDUCT 15.09.2021.DOCX
2.9.4 ensure that when it relies upon the legitimate interests for processing personal information
that those interests are not overridden by the interests or fundamental rights and freedoms
of the data subject(s).
2.10 Where processing is based on the protection of a legitimate interest of the data subject, or
necessary for pursuing the legitimate interest of the responsible party, the bureau must cater for
the objection of such processing by the data subjects, on reasonable grounds relating to his, her or
its particular situation, unless legislation provides for such processing. The right to object to such
processing must be communicated to the data subject, when the bureau communicates the purpose
for processing as specified below in Condition 6 Openness.
Direct collection from the Data subject 5
2.11 In most cases personal information, which by definition includes consumer credit information, is not
collected directly from the data subject by credit bureaus, but emanates from a credit provider. The
credit bureau may also accept information originating from the additional sources prescribed in NCA
Regulations.6
2.12 A credit bureau must accept consumer credit information from any credit provider and may accept
consumer credit information that originates from sources prescribed in the NCA Regulations.
2.13 Credit bureaus notify data subjects of data sources by publishing notification required by section 18
of PoPIA on their websites. The requirements of this notice are elaborated further in Condition 6
Openness.
2.14 In the case of a credit bureau, the indirect collection of personal information falls within the
exceptions provided for in PoPIA, as the collection does not prejudice the legitimate interests of the
data subject and in necessary to maintain the legitimate interests of the responsible party or the
third party to whom the information is supplied.
2.15 Where a credit bureau collects personal information directly from data subjects, the lawful
conditions for processing of personal information will be complied with.
3 CONDITION 3: PURPOSE SPECIFICATION
Collection for a specific purpose7
3.1 If credit bureaus collect personal information directly from a data subject the credit bureau ensure
that the data subject is aware of the specific, explicitly defined, and lawful purpose related to the
function and activity of the credit bureau in processing the data subject’s personal information e.g.
where personal information is collected for dispute resolution.
Section 12 Collection directly from data subject, PoPIA
Section 70(2) of the NCA and Section 18(7) and Reg 19(13) of the NCA regulations
Section 13 Collection for a specific purpose, PoPIA
CBA CODE OF CONDUCT 15.09.2021.DOCX
3.2 If a credit bureau does not collect information directly from the data subject, it verifies the originating
source of the information and ensures that personal information is lawfully collected in terms of the
NCA.
3.3 Unless mandated by law to submit data to the credit bureau, credit bureaus require the supplier of
personal information, to agree in writing that:
3.3.1 where required, the prior consent of the data subject has been obtained; or
3.3.2 the data subject has received proper notification relating to the processing of the data as
required in terms of Section 18(1) of PoPIA.
Retention and restriction of records8
3.4 All credit bureaus have developed and maintain a policy for data retention and destruction that
ensures that records of personal information are not retained any longer than is necessary for
achieving the predetermined purpose for which the information was collected and subsequently
processed, unless required by law, or reasonably necessary for lawful purposes related to credit
bureau functions and activities.
3.5 The credit bureau policy for data retention and destruction contains a schedule which specifies the
periods for retention of records of personal information, the security measures applied to records
that are no longer displayed or used for purposes of credit scoring or credit assessment, and the
destruction or de-identification of records containing personal information. The schedule includes
triggers for such destruction or de-identification of such records when outside of the specified
retention period. The policy also considers the period that Personal Information is retained in excess
of the display period set out in the NCA and documents the retention period in the retention policy
together with a justification for the retention period.
3.6 Personal Information that credit bureaus retain for data quality (i.e. for purposes related to bureau
functions and activities), is retained in a secure environment and is subject to the same security
controls as the data displayed.
3.7 Credit bureaus will destroy or de-identify personal information, as soon as reasonably practicable
after its retention is no longer necessary.
4. CONDITION 4: FURTHER PROCESSING LIMITATION
Further processing to be compatible with purpose of collection 9
4.1 The NCA provides clear definition of the purposes for, and the parameters within which consumer
credit information must be processed.
Section 14 Retention and restriction of records, PoPIA
Section 15 Further processing to be compatible with purpose of collection, PoPIA
CBA CODE OF CONDUCT 15.09.2021.DOCX
Credit bureaus apply reasonable commercial and organisational measures to ensure that the
processing of personal information falls within the purposes defined in the NCA and prescribed in
the NCA Regulations
4.2 If any information is to be processed outside of the normal course of processing stipulated in the
NCA and the Regulations, the processing is assessed, to ensure it complies with PoPIA further
processing requirements.
4.3 Personal Information will not be further processed in a manner that is incompatible with the original
purpose for processing, unless the bureau ascertains that the steps set out in Condition 4 of PoPIA
are met prior to the further processing by conducting a PIIA.
4.4 Where further processing occurs, the credit bureaus will assess: (i) Any link between the purpose
of collection of personal information and reasons for intended further processing; (ii) the relationship
between the data subject and the responsible party, and the context of the collection of Personal
Information; (iii) the nature of the Personal Information e.g. if special categories of data are being
processed; (iv) the possible consequences of intended further processing to the data subject; (v)
appropriate safeguards relating to further processing will be implemented; and (vi) whether in the
circumstances, a data subject may have reasonably expected such further processing.
4.5 If the purpose for processing the Personal Information changes and is no longer compatible with
the original purpose, it will be considered as a new processing activity which will require a separate
legal basis for processing.
5. CONDITION 5: INFORMATION QUALITY
Quality of information10
5.1 Accurate consumer credit information is critical to the credit industry, including in ascertaining risk,
encouraging responsible borrowing, and discouraging the reckless granting of credit as well as
considering the provision of services. To prevent decisions that may unfairly prejudice a data
subject, credit bureaus ensure that the information which may affect these decisions is complete,
accurate, not misleading and updated where necessary, considering the purpose for the processing
of this information.
5.2 The information held by credit bureaus promotes information quality requirements as contemplated
by both PoPIA and the NCA. To facilitate compliance, credit bureaus:
5.2.1 apply the industry agreed data validation rules to ensure that personal information
processed by the bureaus conforms with minimum data quality requirements and filters out
inconsistent, incomplete, and inaccurate information;
5.2.2 have established measures to address and remedy instances where the quality of the
personal information processed by a credit bureau is found to be deficient, and to remedy
Section 16 Quality of information, PoPIA
CBA CODE OF CONDUCT 15.09.2021.DOCX
the deficiency and correct personal information, as soon as reasonably practicable;
5.2.3 comply with the CBA Policy directives governing data quality to promote information quality;
5.2.4 take reasonable measures, including, where appropriate, the conclusion of written
agreements to obtain assurance from sources of information that the personal information
provided to the credit bureau is accurate, up to date, relevant, complete, valid, and not
duplicated;
5.2.5 record data quality requirements and quality assurance processes in credit bureau policies;
and
5.2.6 have established and maintain free consumer dispute processes in terms of the NCA
allowing consumers to challenge inaccurate information contained on the credit bureau
records.
6. CONDITION 6: OPENNESS
Documentation11
6.1 A fundamental objective of PoPIA is to allow the data subject access to and knowledge that his,
hers or its personal information is being processed by responsible parties and operators, in order
to facilitate the ability of a data subject to exercise their rights under PoPIA and protect themselves
from any potential adverse effects of the processing of Personal Information.
6.2 The processing of personal information by credit bureaus is strictly regulated in terms of the NCA.
Credit bureaus demonstrate how they process personal information, using documented and readily
available policies and procedures describing its processing activities.
6.3 To ensure that credit bureaus, as responsible parties, comply with the condition of openness, the
following measures are implemented:
6.3.1 credit bureaus keep detailed records of their processing activities, categories of personal
information and information flows;
6.3.2 credit bureaus maintain the documentation of all processing operations under their
responsibility in compliance with section 51 of the Promotion of Access to Information Act;
6.3.3 credit bureaus have developed and display a PAIA Manual on their website that includes
(i) direction to request access to information; (ii) details of sources from which information
may be collected; (iii) the purpose of the collection of the information; (iv) whether the supply
of the information by the data subject is voluntary or mandatory; (v) where applicable,
details of cross border transfers of information;
11 Section 17 Documentation, PoPIA
CBA CODE OF CONDUCT 15.09.2021.DOCX
6.3.4 credit bureaus appoint an Information Officer and Deputy Information Officers (where
appropriate) to handle requests for access to information;
6.3.5 before providing a record to any person including the data subject, or the data subject’s
duly authorised representative, credit bureaus authenticate the identity of the data subject
or the data subjects authorised representative (if necessary, verifying the authority of the
representative) and confirm the purpose for which the record is required.
Notification to data subject when collecting personal information 12
6.4 Credit bureaus are required to take appropriate steps to communicate to data subjects the
processing activities which data subjects can expect from the bureau by way of a privacy notice.
The privacy notice displayed on the credit bureau’s website and communicated to the data subject,
includes:
6.4.1 the categories of information being collected and where the information is not collected from
the data subject, the source from which it is collected;
6.4.2 the name and address of the credit bureau;
6.4.3 the purpose for which the information is being collected;
6.4.4 whether or not the supply of the information by that data subject is voluntary or mandatory;
6.4.5 the potential consequences of failure to provide the information, if any;
6.4.6 any particular law authorising or requiring the collection of the information;
6.4.7 if the credit bureau intends to transfer the information to a third country or international
organisation and the level of protection afforded to the information by that third country or
international organisation;
6.4.8 the rights a data subject may exercise under certain circumstances;
6.4.9 and the details of the information regulator should a data subject wish to make a complaint.
6.5 Credit bureaus, when acting as the operator, are not obliged to confirm whether the data suppliers
(who are the responsible party) have complied with their obligations to notify the data subject of the
purpose and manner of the processing of the data subject’s personal information for credit
assessments.
6.6 To facilitate further openness and transparency, credit bureaus are required to:
6.6.1 publish on their websites that, to the extent that the information processed by the credit
bureaus is consumer credit information as defined in the NCA, its processing is subject to
Section 18 Notification to data subject when collecting personal information, PoPIA
CBA CODE OF CONDUCT 15.09.2021.DOCX
the provisions of the NCA, the NCA Regulations, and rulings and guidelines of the National
Credit Regulator;
6.6.2 publish on their websites that the data subject has a right to access personal information,
rectify incorrect information and object to the processing of personal information subject to
the requirements for processing of consumer credit information in terms of the NCA;
6.6.3 publish on their websites that the data subject may lodge a complaint with the Information
Regulator and/or the National Credit Regulator as may be applicable and provide contact
details of both the Information Regulator and the National Credit Regulator.
7. CONDITION 7: SECURITY SAFEGUARDS
Security measures on integrity and confidentiality of personal information 13
7.1 PoPIA requires that a responsible party must, in establishing appropriate technical and
organisational safeguards to protect personal information, have regard to generally accepted
information security practices and procedures. Without adherence to generally accepted
information security practices and procedures it would not be possible for a credit bureau to fulfil its
obligations in terms of the NCA and NCA Regulations. Security safeguards established by credit
bureaus are periodically monitored by the NCR. Due to the nature the information processed by a
credit bureau, credit bureaus are required to have robust information security controls, which are
applied to all processing. Credit bureaus do not currently engage in information matching
programmes, however these security safeguards would also apply should a credit bureau engage
in such programmes.
7.2 To comply with the Security Safeguards stipulated in PoPIA, credit bureaus have established and
maintain Information Security Management Systems (“ISMS”) as required in generally accepted
information security practice. The credit bureaus’ ISMS include:
7.2.1 the establishment of appropriate organisational infrastructure;
7.2.2 development of policies (supported by procedures and standards) appropriate to the credit
bureau;
7.2.3 planning information security activities and assigning responsibilities as well as appropriate
resources to the management of information security;
7.2.4 the adoption, of control measures that are appropriate and if any generally accepted control
measures are excluded, the credit bureau provides written justification of the exclusion of
these control measures;
7.2.5 addressing the information and communications technologies employed by the
organisation in processing information, the procedures governing the appropriate use of the
information and communications technologies;
Section 19 Security measures on integrity and confidentiality of personal information, PoPIA
CBA CODE OF CONDUCT 15.09.2021.DOCX
7.2.6 addressing the training of all users of the information and communications technologies in
the procedures governing their use;
7.2.7 IT security policies, systems and controls that comply with appropriate security measures
e.g., vulnerability scanning, and penetration testing reviewed by independent auditors.
7.3 Credit bureaus implement appropriate and reasonable technical and organizational measures to
ensure the ongoing confidentiality, integrity and availability of processing systems, services and
data, by implementing for example:
Confidentiality Integrity Availability
Restricting permissions to a Storage privacy controls (e.g., Incident management
need-to-know basis. operating system controls, local procedures
encrypted storage)
Attribute-based credentials. Asset management controls e.g. Business continuity plans
malware detection (e.g., recovery and
contingency arrangements)
Authentication controls Secure data transfer (e.g., use Malware protections
encryption techniques to prevent
Vulnerability scan
against attacks on data in motion).
Capacity management
7.4 There is organisational and departmental segregation within the credit bureau business to allow for
separation in duties when personal information is being processed.
Information processed by operator or person acting under authority 14
7.5 Where a credit bureau acts as an operator as defined in PoPIA, it may only process personal
information with the knowledge and authorisation of the responsible party. Further, it is obliged to
maintain the confidentiality of the personal information and not disclose it unless required by law or
in the performance of its duties as a credit bureau.
7.6 The security safeguards stipulated in part b paragraph 7 (security measures on integrity and
confidentiality of personal information) above are implemented to all processing by credit bureaus,
including in their capacity as an operator. Where appropriate, security safeguards are included in
written contracts concluded between responsible parties and operators.
Security measures regarding information processed by operator 15
7.7 Whether the credit bureau acts as a responsible party or an operator it will establish and maintain
an effective ISMS.
Section 20 Information processed by operator or person acting under authority, PoPIA
Section 21 Security measures regarding information processed by operator, PoPIA
CBA CODE OF CONDUCT 15.09.2021.DOCX
7.8 Where the credit bureau is a responsible party it will conclude written contracts with all operators
that process personal information under its mandate or in terms of a contract to ensure that the
operator establishes and maintains the security measures necessary to safeguard the integrity and
confidentiality of personal information.
7.9 Credit bureaus include provisions in written contracts requiring that the operator will notify the credit
bureau on an immediate basis if there are reasonable grounds to believe that the personal
information of a data subject has been accessed or acquired by an unauthorised person.
Notification of security compromises16
7.10 In terms of PoPIA a data subject has the right to know if the security of their personal information
has been compromised. The data subject is in the best position to protect him or herself against the
abuse of their personal information but, unless the data subject has knowledge of a compromise,
they are deprived of this right.
7.11 To ensure that credit bureaus comply with their obligations as a responsible party to meet the
requirements of this condition, credit bureaus have developed a Compromise Response Guideline
that is applicable to credit bureaus and describes the processes to be followed in the event of a
security compromise as defined by PoPIA. The guideline ensures timeous notification of security
compromises to the Information Regulator and the data subject where appropriate.
7.12 In the event of a compromise, the affected credit bureau will conduct a risk assessment to determine
the likelihood of harm to the data subject following the compromise and the bureau will ensure that
it offers appropriate support and services free of charge to the affected data subjects.
7.13 Where credit bureaus are the Operator and there is a Personal Information Breach, credit bureaus
will notify the Responsible Party without undue delay after becoming aware of the Personal
Information breach (and in line with notification obligations as per the agreement with the
Responsible party). Credit bureaus will assist the Responsible Party in ensuring compliance with
its obligation to notify the Information Regulator, considering the nature of Processing and the
information available to it, in its capacity as the Operator.
8. CONDITION 8: DATA SUBJECT PARTICIPATION
Access to and correction of Personal Information17
8.1 Data subjects are granted access to their personal information and are able to request correction if
necessary, as contemplated in Sections 23 and 24 of PoPIA. If the accuracy of consumer credit
information is contested by a data subject, credit bureaus comply with the provisions of the NCA
allowing the data subject the opportunity to dispute their personal information free of charge.
Section 22 Notification of security compromises, PoPIA
Section 23 Access to personal information, and section 24 correction of personal information, PoPIA
CBA CODE OF CONDUCT 15.09.2021.DOCX
8.2 Therefore, in fulfilment of the obligations stipulated in the NCA, credit bureaus have established
procedures to provide consumers access to their consumer credit information displayed on their
credit reports, free of charge once in any 12-month period (free credit report). For other data
subjects, the credit bureaus provide this information at a charge.
Access requests
8.3 Upon receipt of a data subject’s request to confirm whether a credit bureau holds personal
information on the data subject and upon authentication of a data subject’s identity, the credit
bureau will issue confirmation to the data subject should the credit bureau hold the information. This
confirmation may be provided in the form of a confirmation letter or a credit report, which indicates
that personal information is held on the data subject.
8.4 On receipt of a data subject request for a record or a description of the personal information about
the data subject held by a credit bureau, credit bureaus will provide to a data subject, a free credit
report of consumer credit information, and a record or description of the personal information held
by the credit bureau, on the relevant data subject. If the data subject is an individual (meaning a
consumer), the first credit report will be issued to consumers free of charge.
8.5 A credit bureau will be entitled to require the data subject to pay a reasonable fee, as may be
prescribed, for extracting and preparing the information, payment of which may be required in
advance. Credit bureaus will not charge a fee with the intention of deterring or prohibiting a data
subject’s request for information.
8.6 Credit bureaus will present the requested information to the data subject in a reasonable manner
and in a format that is understandable.
8.7 Credit bureaus will upon receipt of a request by a data subject for information about the identity of
third parties, or categories of third parties who have or have had, access to the data subjects’
personal information, provide the names of the third parties.
Correction Requests
8.8 Credit bureaus will correct incorrect information that it holds on its database. Where the correction
request is to correct or dispute consumer credit information, credit bureaus will investigate the
request and update consumer credit information on behalf of and on the instruction of the credit
provider (the responsible party). The NCA requires the data provider to confirm the accuracy of the
information, and the bureau to act on their instruction, therefore the credit provider is the responsible
party.
8.9 If the request for correction is to correct consumer credit information, and the credit bureau does
not receive an instruction to correct the information from the responsible party, the credit bureau
will advise the data subject of its decision and inform the data subject that he/she/it may refer a
complaint to the NCR in terms of Section 136 of the NCA or to the Credit Ombud.
CBA CODE OF CONDUCT 15.09.2021.DOCX
8.10 In cases where the credit bureaus have responded to a data subject’s request resulting in a change
to personal information they will, if reasonably practicable, inform each responsible party, operator
or their client to whom the personal information has been disclosed, of the changes by way of future
credit reporting.
Procedure to facilitate data subject participation
8.11 In order to facilitate data subject participation as required by PoPIA, credit bureaus are required to
develop and maintain one or more procedures allowing the data subject to exercise their personal
information rights under PoPIA and/or the NCA. The procedure/s must require bureaus to:
8.11.1 cater for the exercise of all the rights under PoPIA by providing data subjects the ability to
obtain confirmation of information held by the bureau, request restriction of processing,
request access to, and/or a copy of the information, or request the correction of their
personal information under appropriate circumstances, subject to the provisions and
restrictions of the NCA;
8.11.2 ensure the requested information is provided within a reasonable time but no later than 30
business days (unless the credit bureau notifies the data subject that it may take longer)
from receipt of a valid request and payment of the fee, which period of time shall be
determined with due regard for the amount of information to be reported, the format of the
information and the resources required and available to a credit bureau to extract and
present such information;
8.11.3 establish procedures to notify the data subject of actions taken resulting from the data
subject’s request and provide them with the procedures and contact details for submitting
a complaint should they not be satisfied with the outcome of their request;
8.11.4 advise the data subject of his or her right to request the correction of inaccurate information,
in response to any request for information.
9. PROCESSING OF SPECIAL PERSONAL INFORMATION
9.1 Credit bureaus are expressly prohibited from processing the information contained in Regulation
18(3) of the NCA Regulations. These categories of information correlate closely to the categories
of Personal Information defined as special personal information under the PoPIA.
9.2 Section 26 of PoPIA further prohibits the processing of personal information including biometric
information and criminal behaviour, in respect of which a data subject has not yet been found guilty
of an offence.
9.3 The processing of biometric and criminal behaviour information is not expressly prohibited in the
NCA or NCA Regulations and as such credit bureaus may process information of this nature on
behalf of their clients.
CBA CODE OF CONDUCT 15.09.2021.DOCX
9.4 Credit bureaus may process biometric information to verify the identity of a data subject in order to
provide services that enables its clients to prevent or detect fraud.
9.5 The processing of criminal behaviour information may be conducted during background screening
for employment or during employment.
10. PROCESSING OF PERSONAL INFORMATION OF CHILDREN
The NCA stipulates that credit agreements are unlawful if at the time that the agreement was made the
consumer was an unemancipated minor unassisted by a guardian, unless the consumer or person acting
on behalf of the consumer directly or indirectly, by an act of omission, induced the credit provider believe
that the consumer had legal capacity to contract. In terms of PoPIA a child is defined as a natural person
under the age of 18 years who is not legally competent. In those instances where a person under the age
of 18 is no longer regarded as a child by virtue of emancipation or marriage, the PoPIA provision would not
apply. Due to the nature of a credit bureaus regulated activities, a credit bureau would not process
information related to a child as defined in PoPIA.
11. AUTOMATED DECISION MAKING
The prohibition against automated decision making in the context of granting of credit does not directly
affect credit bureaus, as credit bureaus do not make use of automated decisioning in their operations.
Regulation 23A of the National Credit Act, 34 of 2005 (“the NCA”) specifies the steps that a credit provider
has to take in the granting of credit. Examining the records of the credit bureaus is only one step in that
process. In addition, credit providers are obliged to check the affordability of the consumer by inter alia,
checking his income and obtaining bank statements and payslips. Credit bureaus provide a record of how
the consumer is meeting his/her credit obligations on a monthly basis, and whether or not he/she has a
default or judgment, they do not provide decisions or even the basis for a decision on credit in terms of
Regulation 23A of the NCA.
12. INFORMATION MATCHING
The definition of “information matching programmes” does not accord with the business of a credit bureau
in that the information sent to credit bureaus: a) is by way of data strings; b) is loaded to the individual
consumer’s record by way of an ID number; c) no comparison of information is done; and d) no
action/decision is taken by the credit bureau as a result of the upload of information. Information is
transferred from credit/data providers in terms of an industry agreed data layout, via the Data Transmission
Hub, to the credit bureaus. The data layout contains obligatory data fields, which if correctly filled, results in
an automatic upload to a consumer’s credit profile, if not, the data is rejected. No comparison is done by
credit bureaus between the previous information held and the incoming information.
CBA CODE OF CONDUCT 15.09.2021.DOCX
PART C – ENFORCEMENT
1. INTERPRETATION
1.1 Credit bureaus are governed by the NCA and PoPIA. The NCA refers to “consumers” and “consumer
credit information” and PoPIA refers to “data subjects” and “personal information”. In dealing with
Complaints and Enforcement the terms “data subjects” and “personal information” must be interpreted
to include “consumers” and “consumer credit information”.
1.2 The CBA Executive Manager shall, for the purposes of this Part C of the Code, include any person
assigned by the Executive Manager to discharge the Executive Manager’s duties.
1.3 The term “data subject” shall, for the purposes of this Part C of the Code, include a person authorised
to act on behalf of the data subject, and a relevant person appointed by a court of law to manage the
affairs of a data subject.
2. RIGHTS UNDER THE NCA AND POPIA
2.1 Complaints relating to alleged breaches of the NCA must be adjudicated with reference to the NCA and
this Code.
2.2 Complaints by any person relating to the protection of personal information by a credit bureau, alleging
a breach of PoPIA, must be adjudicated with reference to PoPIA and this Code.
2.3 To expedite the resolution of disputes data subjects are encouraged to follow the complaints process
as described in 3 below.
2.4 Nothing in this Code, PoPIA or the NCA prevents a data subject from referring a complaint to the
Regulator or the NCR or the Credit Ombud directly, should they choose to do so.
3. COMPLAINTS PROCESS
3.1 A failure by a CBA member to comply with this Code is deemed to be a breach of the conditions of
lawful processing of personal information.
Complaints to CBA member
3.2 If you believe that a CBA member has breached the terms of this Code, you may lodge a complaint
directly with the CBA member concerned.
3.3 All CBA members have established processes to address complaints in terms of both PoPIA and the
NCA.
3.4 The names, information officers and web addresses of CBA members subject to this Code are
published on the CBA website (www.cba.co.za ).
3.5 CBA members will respond to a complaint within a reasonable time but by no later than 30 (thirty) days
from receipt, or any longer period permitted by law.
CBA CODE OF CONDUCT 15.09.2021.DOCX
3.6 If the data subject is dissatisfied with a decision made by a CBA member, they may refer the complaint
to the CBA.
Complaints to the CBA
3.7 Complaints addressed to the CBA must be made in the prescribed form that requires:
3.7.1 the full names, physical address, email address and contact number of the data subject;
3.7.2 if the data subject is represented by a third party or a competent person acting on behalf of a minor,
the representative or competent person’s detail, including their name, email address and contact
number are required and must be accompanied by documents indicating the authority of the third
party to represent or act on behalf of the data subject;
3.7.3 a description of the alleged unlawful processing or breach of the Code;
3.7.4 the date or dates of the alleged unlawful processing or breach;
3.7.5 if the data subject has addressed a complaint to a CBA member, details of the complaint and the
response of the CBA member are required and must be accompanied with the written evidence
relating to that complaint; and
3.7.6 the reasons that the data subject is aggrieved with the decision made by the CBA member.
Investigation
3.8 The CBA will investigate the complaint and respond to the data subject within 30 (thirty) days advising
of the outcome of its investigation.
3.9 The CBA Executive Manager may, after receipt of the complaint, communicate with the Information
Officer of the CBA member against whom the complaint is made to obtain a response.
3.10 The CBA’s Executive Manager may engage directly with the data subject and the Information Officer
of the CBA member to attempt to resolve the complaint.
3.11 If after investigating the complaint and the response of the CBA member the CBA Executive Manager
believes that it may be possible to secure a settlement between the parties or obtain satisfactory
assurances that the conduct complained of will not be repeated, they will use their best endeavours to
settle the matter without further investigation.
Referral to an independent adjudicator
3.12 If after completing the investigation the CBA Executive Manager is unable to resolve the dispute the
matter will be referred to an independent adjudicator for consideration and resolution.
3.13 The independent adjudicator will be provided with all documents submitted by the disputing parties and
a report by the CBA Executive Manager within 30 (thirty) days of the CBA Executive Manager
determining that the dispute cannot be resolved.
CBA CODE OF CONDUCT 15.09.2021.DOCX
3.14 The independent adjudicator will be entitled to request further written submissions from the disputing
parties and the information from the CBA Executive Manager.
3.15 The independent adjudicator will provide a written decision on the dispute and reasons for the decision
within 30 (thirty) days of the dispute being referred to him/her or such longer period as is reasonably
necessary to secure written submissions and information to determine the dispute fairly.
4. INTERPRETATION AND DISPUTES RELATING TO THE CODE BY CBA MEMBERS
4.1 If a CBA member wishes to request an interpretation of the Code, or a complaint against another CBA
member relating to an alleged breach of the Code, it may address the request or complaint in writing to
the CBA Executive Manager.
4.2 If the request or complaint cannot be resolved by the CBA Executive Manager, it will be placed on the
agenda for discussion at the next meeting of the Legal and Compliance representatives of the CBA
members.
4.3 If at the meeting of CBA Legal and Compliance representatives a request or a complaint cannot be
resolved by the representatives attending the meeting, the CBA Executive Manager must refer the
request or complaint to the CBA Executive Committee.
4.4 The CBA Executive Committee may, in its discretion:
4.4.1 make a decision and communicate the decision to the members of the CBA by email to its
nominated representatives; or
4.4.2 refer the request or complaint to legal counsel for consideration and opinion; or
4.4.3 recommend to the CBA member requesting the interpretation or making the complaint to, at the
CBA member’s cost, obtain an opinion from legal counsel and provide this to the CBA Executive
Manager.
4.5 Once advice or an opinion has been obtained from legal counsel the CBA Executive Manager will
circulate this to the CBA Executive Committee and members of the CBA with a view to resolving the
request or complaint.
4.6 If any member of the CBA remains aggrieved by the advice or opinion from legal counsel, they may
request the CBA Executive Manager to again refer the matter to the CBA Executive Committee, which
may, but is not obliged to, appoint an independent adjudicator to consider and determine the request
or complaint.
4.7 Nothing in this Code prevents any member of the CBA from obtaining independent advice or an opinion
from legal counsel or a subject matter expert, as may be appropriate and providing this to the CBA
Executive Committee.
CBA CODE OF CONDUCT 15.09.2021.DOCX
5. INDEPENDENT ADJUDICATOR
5.1 The CBA Executive Committee will appoint independent adjudicators who meet the criteria stipulated
under the heading “Qualifications and Criteria for Independent Adjudicators” provided for below to
adjudicate on disputes referred to the CBA by data subjects or its members.
6. QUALIFICATIONS AND CRITERIA FOR INDEPENDENT ADJUDICATORS
6.1 To be eligible for appointment as an independent adjudicator of the CBA, and to continue to hold that
office, a person must—
6.1.1 not be subject to any disqualification set out below;
6.1.2 not have any interests referred to below;
6.1.3 be a natural person and a citizen of South Africa, who is ordinarily resident in the Republic; and
6.1.4 have suitable qualifications and/or experience in economics, law, commerce, industry and
consumer affairs.
6.2 A person is disqualified for the appointment as an independent adjudicator of the CBA if that person—
6.2.1 is an office-bearer of any political party, movement, organisation or body of a partisan political
nature;
6.2.2 personally, or through a spouse, partner, immediate family member or associate—
6.2.2.1 has or acquires a direct or indirect interest (whether financial or otherwise) in a member of the
CBA or the CBA itself; or
6.2.2.2 has or acquires an interest in a business or enterprise, which may conflict or interfere or
perceive to conflict or interfere with the proper performance of the duties of an independent
adjudicator of the CBA.
6.2.3 is an unrehabilitated insolvent or becomes insolvent and the insolvency results in the sequestration
of that person’s estate;
6.2.4 has been removed from a position of trust on grounds of misconduct involving fraud,
misappropriation of money, or any dishonesty;
6.2.5 is subject to an order of a competent court holding that person to be mentally unfit or mentally
disordered;
6.2.6 within the previous 10 (ten) years has been convicted in the Republic of South Africa or elsewhere
of theft, fraud, forgery or uttering a forged document, perjury, an offence under the Prevention and
Combating of Corrupt Activities Act, No. 12 of 2004, an offence under the Financial Intelligence
Centre Act, No. 38 of 2001, or an offence involving dishonesty; or
CBA CODE OF CONDUCT 15.09.2021.DOCX
6.2.7 has been convicted of any other offence.
6.3 A financial interest does not include an indirect interest held in any fund or investment if the person
contemplated in that subsection has no control over the investment decisions of that fund or investment.
6.4 If approved and appointed as an independent adjudicator, then such independent adjudicator must
promptly inform the CBA Executive Manager in writing after acquiring an interest that is, or is likely to
become, an interest contemplated above.
6.5 If, at any time, it appears to an independent adjudicator that a matter referred to him/her for adjudication
concerns an interest referred to in 6.4, that independent adjudicator must—
6.5.1 immediately and fully disclose the nature of that interest to the CBA Executive Manager; and
6.5.2 withdraw from the matter as adjudicator.
6.6 An independent adjudicator must not –
6.6.1 engage in any activity that may undermine the integrity or reputation of the CBA or any of its
members;
6.6.2 adjudicate or influence the proceedings in any matter before adjudication if that person has an
interest—
6.6.2.1 contemplated above; or
6.6.2.2 that precludes that person from performing the functions of an independent adjudicator in a
fair, unbiased and proper manner;
6.6.3 make private use of, or profit from, any confidential information obtained as a result of performing
that person’s functions as an independent adjudicator of the CBA; or
6.6.4 divulge any information referred to any third party, except as required as part of that person’s official
functions as an independent adjudicator of the CBA.
6.7 The Executive Manager of the CBA will seek appropriately qualified persons to be appointed as
independent adjudicators.
7. APPOINTMENT AND POWERS OF ADJUDICATOR
7.1 The CBA Executive Committee may appoint one, or if it deems necessary, more than one of the
independent adjudicators approved by the CBA Executive Committee to hear the complaint and
adjudicate thereon.
7.2 The adjudicator must apply the principles stipulated in Section 44 of PoPIA in determining any decision
which relates to the unlawful processing of personal information.
CBA CODE OF CONDUCT 15.09.2021.DOCX
7.3 The adjudicator may in addition to information provided to him or her, call for further information or
summon the complainant or representatives of a CBA member to provide oral evidence and, if the
adjudicator deems appropriate, allow cross-examination of a witness.
7.4 On completion of his or her investigation the independent adjudicator must send a report containing its
determination, together with reasons therefore, to the CBA Executive Manager and the CBA member.
7.5 If the CBA member continues to be in breach of this Code the adjudicator may make or give any order,
declaration or direction requiring that the CBA member takes any specific actions within a reasonably
stipulated period of time, failing which any one or more of the sanctions available in the CBA’s
constitution may be imposed, and such determination shall, unless formally disputed, be final and
binding upon the CBA member.
7.6 If any member of the CBA remains aggrieved by the decision the CBA member may refer the dispute
to the Information Regulator in terms of Chapter 10 of PoPIA.
7.7 Nothing in this Part D shall in any way restrict or detract from the provisions of Chapter 10 of PoPIA.
8. REPORTS TO REGULATOR
8.1 The CBA Executive Manager will within 5 (five) months of the end of the financial year of the Regulator
submit a report to the Regulator on the operation of the Code during the financial year.
8.2 The report will be in the form required by the Regulator and will describe complaints made to the
Regulator during the financial year immediately preceding the report, including the number of
complaints referred to adjudication, the nature of the complaints and the decisions made by the
adjudicators.
CBA CODE OF CONDUCT 15.09.2021.DOCX
PART D – ADMINISTRATION OF CODE OF CONDUCT
1. COMPLIANCE WITH CHAPTER 7 OF POPIA
Issue of Code of Conduct
1.1. This Code of Conduct applies to credit bureaus registered in terms of Section 43 of the NCA that is a
member (regardless of category of membership) of the CBA.
1.2. Credit bureaus who are members of the CBA have mandated the CBA to apply to the Information
Regulator for the issue of this Code of Conduct. It is noted that issuance and enforcement of this Code
of Conduct in accordance with Chapter 7 of PoPIA, will render section 57 (1) and section 58 of PoPIA not
applicable to CBA members in accordance with section 57 (3).
1.3. The Code of Conduct incorporates the conditions for the lawful processing of personal information and
provides functional equivalence of obligations set out in those conditions that are applicable to the conduct
of credit bureaus as regulated by the NCA and as may be prescribed by the NCA Regulations.
Monitoring
1.4. The CBA has drafted a Credit Bureau Compliance Monitoring Plan which it will use in the monitoring of its
members adherence to this Code of Conduct. This Credit Bureau Compliance Monitoring Plan is attached
hereto.
Review
1.5. This Code of Conduct will be reviewed annually by no later than the anniversary of the date of the coming
into force of this Code of Conduct.
1.6. The review of this Code of Conduct may be accelerated:
1.6.1. if an earlier review is prescribed by the Regulator in writing addressed to the CBA Executive Manager;
or
1.6.2. required in terms of a ruling made by the Regulator; or
1.6.3. if directed to do so by the Regulator in an Information Notice issued in terms of Section 90 or an
Enforcement Notice issued in terms of Section 95 of PoPIA; or
1.6.4. if any court having jurisdiction over credit bureaus who is a member of the CBA directs that any
provisions of this Code of Conduct are unlawful.
Amendment of the Code of Conduct
1.7. The CBA will revoke or make any amendments to the Code of Conduct as directed by the Regulator or
mandated by its members, in compliance with Sections 60 to 63 of PoPIA.
CBA CODE OF CONDUCT 15.09.2021.DOCX
Publication of Code of Conduct
1.8. From the date that the Code of Conduct comes into force the CBA will cause publication of the Code on
its website and require that its members publish the Code on their websites.
1.9. The CBA will make copies of the Code of Conduct available in hardcopy form to persons requesting a
copy in that form.
Interpretation
1.10. The interpretation of PoPIA and of this Code of Conduct as they relate to the operation of credit bureaus
may be made by the CBA Executive Manager. No interpretation made by the CBA Executive Manager
shall be binding on the Information Regulator or detract from any of the powers of the Information
Regulator stipulated in Chapter 10 of PoPIA.
Revision History
1.11. The CBA Executive Manager will ensure that a revision history of this Code of Conduct will be established
and maintained.
1.12. The revision history must record the material aspects of any decisions or rulings made by the Regulator
or by the CBA Executive Committee that cause amendments to be made to this Code of Conduct.
CBA CODE OF CONDUCT 15.09.2021.DOCX
Prohibition or Restriction of Certain Conventional Weapons Act, 2008
