Responsible Party (POPIA)

Section 1 of the Protection of Personal Information Act 4 of 2013 defines a responsible party as a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information. The "purpose and means" test mirrors the controller concept under the EU GDPR and is the single most important status determination in POPIA compliance — the responsible party bears primary statutory liability for the eight conditions in Chapter 3.

Under section 8, the responsible party must ensure the conditions for lawful processing are given effect, even when processing is outsourced to an operator. Sections 19 to 22 place specific duties on the responsible party: implement appropriate technical and organisational security measures, conclude a written contract with every operator, notify the Information Regulator and data subjects of security compromises, and respond to data-subject access requests under section 23. The Information Regulator\'s enforcement notices and administrative fines (up to R10 million under section 109) are directed at the responsible party.

In drafting, care must be taken where two or more parties jointly determine purpose and means — for example a franchisor and franchisee, or an insurer and broker. They become joint responsible parties and must regulate responsibility between them contractually. A party that processes information only on the instructions of another is an operator, not a responsible party, and its contractual obligations are governed by section 21.