POPIA — POPIA Standard / Guideline: Standard for Handling Complaints Regarding a Code of Conduct (source: https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-Standard-CodeOfConduct-Complaints-20210301.pdf) STANDARD FOR MAKING AND DEALING WITH COMPLAINTS IN A CODE OF CONDUCT (Prescribed in terms of section 65 of the Protection of Personal Information Act No 4 of 2013) Table of Contents 1. INTRODUCTION ............................................................................................................................... 3 2. DEFINITIONS .................................................................................................................................... 3 3. PURPOSE OF A COMPLAINTS STANDARD ....................................................................................... 4 4. GENERAL PRINCIPLES ...................................................................................................................... 5 5. COMPLAINT HANDLING BY A RESPONSIBLE PARTY ........................................................................ 5 6. COMPLAINT HANDLING BY AN INDEPENDENT ADJUDICATOR ....................................................... 6 7. RIGHTS OF AN AGGRIEVED RESPONSIBLE PARTY OR DATA SUBJECT ............................................. 7 1. INTRODUCTION 1. The Information Regulator (Regulator) has in accordance with the provision of section 65(1)(b) of the Protection of Personal Information Act No 4 of 2013 (POPIA), issued Guidelines relating to the making and dealing with complaints under approved codes of conduct (code). 2. Section 63(1) of POPIA provides that a code may prescribe procedures for making and dealing with complaints alleging a breach of a code without limiting or restricting the provisions of Chapter 10 of POPIA. 3. Once a code is issued under Section 60 of POPIA and it is in force, failure to comply with such a code is deemed to be a breach of the conditions for the lawful processing of personal information referred to in Chapter 3 of POPIA and such failure shall be dealt with in terms of Chapter 10 of POPIA. 4. Section 63(2)(a)(i) and (ii) of POPIA stipulates that if a code sets out procedures for making and dealing with complaints, the Regulator must be satisfied that the code meets the prescribed standards (Standards) and Guidelines referred to in paragraph 1.1 above. 5. These Standards are issued by the Regulator in terms of Section 63(2)(a)(i) of POPIA and must be read in conjunction with the Guidelines, POPIA and Regulations made in terms of Section 112(2) of POPIA (Regulations)- we have defined ‘Regulations’ below and should not cite them in full hereunder. 2. DEFINITIONS The definitions used in these Standards are consistent with the definitions in POPIA, the Regulations and the Guidelines as issued by the Regulator. Below are the relevant definitions to these Standards- 1. “Code of conduct” means a code of conduct issued in terms of Chapter 7; 2. “Data Subject” means the person to whom personal information relates; 3. “Guidelines” mean Guidelines to Develop Codes of Conduct issued by the Regulator in terms of section 65 of POPIA; 4. “Regulator” means the Information Regulator established in terms of section 39 of POPIA; 5. “Regulations” mean Regulations made in terms of Section 112(2) of POPIA; 6. “Relevant body/bodies” refers to any specified body or class of bodies, or any specified industry, profession, or vocation or class of industries, professions, or vocations that in the opinion of the Regulator has sufficient representation; 7. “Relevant stakeholders” mean stakeholders, affected stakeholders or a body representing such stakeholders; and 8. “Responsible Party” means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing of personal information. 3. PURPOSE OF A COMPLAINTS STANDARD The purpose of this Standard is to ensure that a code, which sets out the procedure for making and dealing with complaints, complies with the standards below. 4. GENERAL PRINCIPLES A Code which sets out the procedure for making and dealing with complaints must: 1. be fair, transparent, impartial and responsive; 2. observe the principles of natural justice and procedural fairness; 3. be publicly available and accessible to all; 4. be written in plain English and any official language, if necessary; 5. provide for the expeditious resolution of complaints; 6. prescribe requirements to be satisfied by any person who has grounds to lodge a complaint; 7. prescribe the procedure that will be utilised in lodging a complaint; and 8. specify the nature of reasonable assistance, as may be necessary in the circumstances, to enable any person to lodge a complaint. 5. COMPLAINT HANDLING BY A RESPONSIBLE PARTY 1. A Code must be explicit in providing for complaints to be first lodged with a responsible party bound by the Code, unless exceptional circumstances, referred to in paragraph 26.2 of the Guidelines exist. 2. A code must - 2.1. outline the form and manner in which a complaint must be lodged with the responsible party; 2.2. provide the details of a person with whom a complaint must be lodged; 2.3. outline the requirements which must be met in a case where a complaint is lodged on behalf of a data subject; 2.4. outline the steps which will be followed to investigate a complaint, from receipt to the resolution thereof; 2.5. make provision for notifying the complainant on the progress of the investigation; 2.6. stipulate a reasonable timeframe within which a complaint must be resolved; 2.7. make provision for informing the complainant of the outcome of the complaint and reasons for the decision taken; 2.8. outline the remedy that can be provided by a responsible party; 2.9. outline the circumstances in which a complaint can be escalated directly to the Regulator as provided for in the Guidelines; 2.10. make provision for informing a complainant of their right to refer a complaint to the independent adjudicator if they are aggrieved by the decision of a responsible party; 2.11. outline the procedure for referring a complaint to an independent adjudicator; 2.12. provide the time frame within which a complaint may be referred to an independent adjudicator; and 2.13. provide details of an independent adjudicator. 6. COMPLAINT HANDLING BY AN INDEPENDENT ADJUDICATOR 1. A code must prescribe the procedure to be followed by an independent adjudicator when investigating a complaint referred to him or her. 2. The procedure referred to in paragraph 6.1 above must- 2.1. outline the form and manner of the referral of complaint from a responsible party; 2.2. outline the circumstances under which legal representation may be allowed; 2.3. outline an adjudication hearing process which must be accessible to all; 2.4. stipulate a reasonable time frame within which a complaint must be resolved; and 2.5. outline the determination, including a declaration, order or direction that can be taken by an independent adjudicator. 7. RIGHTS OF AN AGGRIEVED RESPONSIBLE PARTY OR DATA SUBJECT 1. A code of conduct must- 1.1. make provision for informing a responsible party or data subject of their right to- 1.1.1. submit a complaint to the Regulator if they are aggrieved by the decision of an independent adjudicator; 1.1.2. institute civil proceedings regarding the alleged interference with the protection of their personal information as provided for in section 99 of POPIA. 1.2. outline reasonable timeframes within which a responsible party or data subject aggrieved by the decision of the independent adjudicator may submit a complaint to the Regulator. 1.3. provide a link 1 to a complaint form where a responsible party or data subject aggrieved by the decision of the independent adjudicator may submit a complaint to the Regulator; and 1.4. provide the relevant contact details of the Regulator. 8. This Standard may be reviewed by the Regulator from time to time as and when it may become necessary. Adv. P Tlakula Chairperson Date: 1 March 2021 A link will be made available on the Regulators website when the online complaints process is accessible.

---