Every business hands personal information to suppliers. The payroll bureau holds salaries and ID numbers. The CRM vendor hosts the client base. The development partner can read the production database. Under POPIA each of these suppliers is an operator: a party that processes personal information on your behalf. The Act is specific about what that relationship must look like, and most supplier files hold nothing that meets it.
What the Act requires
Section 21 requires a written contract between you and every operator. The contract must oblige the operator to secure the information to the standard POPIA sets for you, and to treat it as confidential. Section 21 also requires the operator to notify you immediately when it has reason to believe the information has been accessed by anyone unauthorised. Without that clause, your first news of a breach at a supplier may arrive months late, while your own duty to report it started the day the supplier knew.
An SLA does not cover this. Service agreements deal with uptime, response times and fees. The operator clauses deal with what the supplier may do with the information, how it must protect it, and what happens when something goes wrong. A supplier contract can carry both, but the second set has to be written in.
Accountability stays with you
Outsourcing the processing never outsources the responsibility. If an operator leaks your client data, the Information Regulator’s questions come to you, because POPIA makes the responsible party answerable for its operators. The written contract is how you show you took that seriously before the incident instead of after it.
What a working operator clause covers
- What the supplier may process, and for what purpose only.
- The security measures the supplier must keep in place.
- Confidentiality, extended to the supplier’s own staff and subcontractors.
- Immediate notice to you on any suspected compromise.
- Return or destruction of the information when the contract ends.
The practical exercise is a supplier inventory: list every vendor that touches personal information, then check each contract for these clauses. The gaps are usually the oldest and most trusted suppliers, because the relationship predates the Act.
Not sure which of your suppliers count as operators? Tell us what’s on fire