Page 53 - PHG_Q&A_Eng.indd
P. 53
POPI, as it falls outside the scope of the definition of an operator.
In your case, it would appear that the third party that stores your information
does “process” (storing) personal information on your behalf, such storage
presumably being on the basis of an agreement with you. This makes the entity
an operator processing personal information on your behalf.
Important to note is that the outsourcing of personal information to an operator
does not release you as the responsible party from any of your obligations
under POPI. This means, that should the operator contravene POPI in any way
in respect of the data it stores for you, you will be held responsible. It is therefore
vital that a proper operator agreement be in place between a responsible Commercial
party and operator to ensure that the operator obligations in respect of POPI
are clearly stipulated.
Our advice is to obtain the assistance of a POPI specialist to review any existing
agreement you may have with the operator and if necessary, help put an
appropriate operator agreement in place to ensure that your use of the data
storage company is POPI compliant.
48
