POPIA — POPIA Standard / Guideline: Checklist for a Code of Conduct (source: https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-Checklist-CodeOfConduct-20210303.pdf) APPENDIX 1 CHECKLIST FOR SUBMISSION OF APPLICATION FOR APPROVAL OF A PROPOSED CODE OF CONDUCT Items Prior to submitting a proposed code of conduct, please ensure that the following information and/or documents (if relevant to you) form part of your submission to the Information Regulator. This is not an exhaustive list and serves as a guide to assist you. NB: in order to speed up the processing of your application, please provide sufficient information and reference the relevant sections of the proposed code. Check the checkbox with a when a task is completed 1. Have you provided a clear explanatory statement outlining the purpose and scope of the proposed code with relevant supporting documentation? 2. Have you defined your role? Identify if you belong to a specified body or class of bodies. Do you belong to a specified industry, profession, vocation or class of industries? 3. Have you furnished information which shows evidence of sufficient representation? 4. Have you identified the members of the relevant body bound by a proposed code? 5. Have you identified the role of members of a relevant body that processes personal information? 6. Have you illustrated how high risk processing of personal information is monitored? 7. Have you identified if the proposed code has national and/or international application? 8. Have you identified monitoring and reporting mechanisms to ensure compliance with the proposed code? 9. Have you outlined the manner in which breaches of POPIA will be dealt with and the mechanisms that will be available to data subjects in the event personal information is compromised? 10. Have you included information on consultations with relevant stakeholders that you held whilst developing your proposed code? Please reference the relevant sections of the proposed code of conduct and specify the consultation period? 11. Have you attached the views of different stakeholders secured during consultations? 12. Have you confirmed that the proposed code is compliant with POPIA? 13. Is the relevant body responsible for administering the proposed code and monitoring the effectiveness of the proposed code? 14. Which of the following is applicable to a) any specified information or class of your proposed code of conduct? information; b) any specified body or class of bodies; c) any specified activity or class of activities; or d) any specified industry, profession, or vocation or class of industries, professions, or vocations 15. Have you specified the administrative mechanisms of the relevant body? 16. Have you notified the Regulator of your Yes intention to develop a proposed code? If Click here to select the date yes, please specify the date. No 17. Does your proposed code of conduct a) for information matching programmes if specify appropriate measures- such programmes are used within a specific sector; or b) for protecting the legitimate interests of data subjects insofar as automated decision making is concerned; 18. Does the proposed code of conduct a) procedures that meet the prescribed prescribe - standards in the guidelines issued by the Regulator relating to the making of and dealing with complaints; b) procedures for the appointment of an independent adjudicator to whom complaints may be made; c) procedures for the requirement of the adjudicator to prepare and submit a report to the Regulator- i) on the operation of the proposed code during that financial year; and ii) specify the number and nature of complaints made to an adjudicator under the proposed code during the relevant financial year. 19. Please reference the relevant parts of the proposed code of conduct that deal with the expiry of the proposed code.

---