Operator Agreements Under POPIA: What They Are and What to Put in Them

Almost every business now sends personal information to someone else to handle: a payroll bureau, a cloud host, an accounting package, an email platform, a call centre. POPIA calls the business that decides why and how the information is used the "responsible party", and the supplier that handles it on that business's behalf the "operator". Section 21 requires a written contract between them. That contract is usually called an operator agreement or a data processing agreement.

General information compiled from public sources, not legal advice. Contracts with large liability or health data should be reviewed by someone qualified.

Who is the responsible party and who is the operator?

The test is who decides the purpose and means of the processing. A company that collects its customers' details and chooses to store them in a cloud service is the responsible party. The cloud service, handling that data only as instructed, is the operator. A business can be both at once: a software company is the responsible party for its own staff and customers, and the operator for the data its customers load into its product.

If a supplier starts deciding for itself what to do with the data, for example using it to build its own marketing lists, it stops being a mere operator and takes on responsible-party duties of its own.

What POPIA requires

• Section 20: an operator must process only with the knowledge or authorisation of the responsible party, and treat the information as confidential.
• Section 21(1): the responsible party must have a written contract with the operator that ensures the operator establishes and maintains the security measures POPIA requires.
• Section 21(2): the operator must tell the responsible party immediately if it has reasonable grounds to believe information was accessed or acquired by an unauthorised person.
• Section 19: the responsible party must keep information secure, and that does not stop when it is handed to a supplier.
• Sections 72 and following: rules on transferring personal information outside South Africa.

The clauses that matter

1. Instructions only. The operator processes the information only on the responsible party's documented instructions and for the agreed service. No use for its own purposes.
2. Confidentiality. Everyone at the operator with access is bound by confidentiality.
3. Security. A short statement of the safeguards: access control, encryption in transit, separation of customers' data, logging and backups. Avoid promising specifics you cannot keep.
4. Breach notice. A time limit, in hours, for telling the responsible party, and what the notice must contain. Common contract periods are 24 to 72 hours. POPIA itself says "immediately", so a contract deadline should be a long-stop and not an excuse to wait.
5. Sub-processors. Whether the operator may use other suppliers, how the responsible party is told of changes (often 30 days' notice with a right to object), and that the operator stays responsible for them.
6. Data subject requests. The operator passes on requests from individuals and helps the responsible party answer them.
7. Location and transfers. Where the data is held and whether it may move abroad. Be honest rather than promising a location you cannot guarantee.
8. Audit and information. The operator provides what the responsible party reasonably needs to check compliance, such as a security summary and its sub-processor terms.
9. Return and deletion. How the customer can export its information at the end, how quickly it is deleted afterwards (including from backups as they expire), and what the operator may keep because the law requires it.
10. Governing law and conflict. South African law, and that the operator agreement prevails over the main terms on personal information.

Sending information abroad

Many South African businesses use cloud tools whose servers or support staff are overseas. POPIA's section 72 allows a transfer to someone in another country where the recipient is subject to law, a binding corporate rule or a binding agreement that gives similar protection, or where the data subject consents, or in other listed cases such as where the transfer is necessary to perform a contract with the person. Check how each supplier describes its own transfer arrangements, and record the result. Many large providers publish a standard data processing addendum that you accept online.

Click-through or signed?

For many small customers an agreement accepted online when the customer creates an account is practical and valid, as long as you keep a record of when and by whom it was accepted. For larger customers, regulated sectors or sensitive data such as health information, use a signed agreement written for that product and that data.

Checking your suppliers

1. List every supplier that touches personal information. Your record of processing is the best starting point.
2. For each, decide whether it is an operator, a responsible party in its own right (such as a bank), or neither.
3. For each operator, save the signed or accepted agreement, with the date and version, where you can find it.
4. Note where the data is held and any sub-processors.
5. Review the list at least once a year and whenever you add or change a supplier.

Common gaps

• No written contract at all because "it's just a cloud tool".
• Relying on the supplier's website privacy notice instead of a contract.
• A contract that does not mention breach notice or deletion.
• No record of which suppliers have subcontractors.
• Contractors or part-time staff who handle personal information without any confidentiality or POPIA terms.

ComplianceDesk's template library includes an operator (data processing) agreement and a vendor register, so each supplier's agreement, location and review date are in one place.