Menu Close

FREE POPIA TOOLKIT

CONSENTS

Requirements Under POPIA

Obtaining & Managing

Under the Protection of Personal Information Act (POPIA), obtaining and managing consents is a critical aspect of compliance. Organizations must adhere to specific requirements to ensure that consents are obtained and managed effectively.

Here are the key requirements:

  1. Informed Consent:
    1. Consent must be informed, meaning individuals must have a clear understanding of what they are consenting to.
    2. Provide detailed information about the purposes for which the personal information will be used or processed.
  2. Specific Consent for Each Purpose:
    1. Obtain separate consents for each specific purpose of processing personal information.
    2. Clearly outline the different purposes and allow individuals to choose which purposes they consent to.
  3. Unambiguous Consent:
    1. Consent must be unambiguous and provided through an affirmative action.
    2. Use clear and affirmative language, such as checkboxes or signature fields, to indicate consent.
  4. Revocable Consent:
    1. Consent must be revocable at any time by the individual.
    2. Inform individuals of their right to withdraw consent and provide easy mechanisms to do so.
  5. Consent for Sensitive Information:
    1. Obtain explicit consent for processing sensitive personal information.
    2. Sensitive information includes data related to race, ethnicity, religious beliefs, health, sexual orientation, etc.
  6. Validity of Consent:
    1. Ensure that consent is validly obtained before processing personal information.
    2. Avoid obtaining consent through deceptive or misleading practices.
  7. Consent for Children:
    1. Obtain parental or guardian consent when processing personal information of children under the age of 18.
    2. Ensure that the consent process is age-appropriate and easily understandable for children.
  8. Record-Keeping:
    1. Maintain records of consents obtained, including the date, time, method, and purpose of consent.
    2. Keep records to demonstrate compliance with POPIA requirements.
  9. Consent Documentation:
    1. Provide individuals with documentation or confirmation of their consent.
    2. Include details of the consent given, such as the purposes, scope, and duration of consent.
  10. Regular Consent Reviews:
    1. Regularly review and update consents to ensure they remain valid and up-to-date.
    2. Seek renewed consent if there are changes to the purposes or processing activities.
  11. Training and Awareness:
    1. Train employees on obtaining and managing consents in accordance with POPIA.
    2. Ensure staff members understand the importance of obtaining valid and informed consent.
  12. Consent Communication:
    1. Communicate clearly and concisely about the consent process and its implications.
    2. Use plain language and avoid technical jargon to ensure individuals understand the consent terms.
  13. Consent Language:
    1. Use language that is easily understandable and accessible to all individuals.
    2. Avoid complex legal terms or ambiguous language in consent forms.
  14. Consent Duration:
    1. Specify the duration for which consent is valid and the conditions under which it may expire.
    2. Seek renewed consent if the original consent period expires or if there are changes in processing purposes.
  15. Consent Withdrawal Process:
    1. Provide individuals with a simple and accessible process to withdraw their consent.
    2. Clearly outline the steps individuals need to take to withdraw consent.

By following these requirements, organizations can ensure that their consent practices comply with POPIA and respect individuals’ rights to privacy and control over their personal information.

Guidance

Obtain & Manage Consents

Obtaining and managing consents under the Protection of Personal Information Act (POPIA) requires careful planning and execution.

Here is a comprehensive guide on how organizations can effectively obtain and manage consents:

    1. Clear and Transparent Communication:
      1. Clearly communicate to individuals the purposes for which their personal information will be used or processed.
      2. Provide concise and easy-to-understand explanations about the consent process and its implications.
    2. Use of Plain Language:
      1. Use plain language in consent forms and notices to ensure individuals understand the terms and conditions.
      2. Avoid complex legal jargon that may confuse or mislead individuals.
    3. Obtain Explicit Consent for Sensitive Information:
      1. When processing sensitive personal information, such as health or financial data, obtain explicit consent from individuals.
      2. Clearly explain why this sensitive information is being collected and how it will be used.
    4. Multiple Consent Options:
      1. Offer individuals multiple options for providing consent, such as checkboxes or electronic signatures.
      2. Allow individuals to choose the specific purposes for which they are providing consent.
    5. Unambiguous Consent Mechanisms:
      1. Use clear and unambiguous consent mechanisms that require an affirmative action from the individual.
      2. Avoid pre-ticked checkboxes or implied consent methods.
    6. Consent Documentation:
      1. Maintain accurate and up-to-date records of all consents obtained.
      2. Document the date, time, method, and purpose of consent for each individual.
    7. Revocable Consent:
      1. Inform individuals of their right to withdraw consent at any time.
      2. Provide easy and accessible methods for individuals to revoke their consent, such as an online form or email.
    8. Consent Duration and Renewal:
      1. Specify the duration for which consent is valid and the conditions under which it may expire.
      2. Seek renewed consent if there are changes in processing purposes or if the original consent period expires.
    9. Consent Training for Staff:
      1. Train employees on the proper procedures for obtaining and managing consents.
      2. Ensure staff members understand the importance of obtaining valid and informed consent.
    10. Consent Reviews and Audits:
      1. Regularly review and audit consent practices to ensure compliance with POPIA requirements.
      2. Conduct periodic assessments of consent forms and processes to identify areas for improvement.
    11. Privacy Notices:
      1. Provide individuals with clear and concise privacy notices that outline their rights and how their personal information will be used.
      2. Include information on how to contact the organization for questions or concerns about consent.
    12. Consent Language and Formatting:
      1. Use a consistent format for consent forms and notices to make them easy to read and understand.
      2. Highlight key information such as purposes of processing, data retention periods, and rights to withdraw consent.

    By following these guidelines, organizations can establish robust processes for obtaining and managing consents that are compliant with POPIA and respectful of individuals’ privacy rights.

    Examples Consents

    Best Practices

    Obtaining & Managing Consents

    Here are some examples of best practices for obtaining and managing consents under the Protection of Personal Information Act (POPIA):

    Obtaining & Managing Consents

    1. Consent Forms:
      1. Use clear and concise consent forms that are easy to understand.
      2. Clearly state the purpose for which the consent is being obtained.
      3. Include information about the specific types of personal information that will be collected and processed.
      4. Provide options for individuals to consent or withhold consent for each specific purpose.
    2. Consent Mechanisms:
      1. Use explicit consent mechanisms, such as checkboxes or electronic signatures, that require individuals to take a positive action to indicate their consent.
      2. Avoid pre-ticked checkboxes or other forms of implied consent.
    3. Sensitive Information:
      1. Obtain explicit consent from individuals before collecting and processing sensitive personal information.
      2. Clearly explain why the sensitive information is being collected and how it will be used.
      3. Ensure that sensitive information is stored securely and accessed only by authorized personnel.
    4. Withdrawal of Consent:
      1. Inform individuals of their right to withdraw consent at any time.
      2. Provide clear instructions on how individuals can withdraw their consent, such as through an online form or email.
      3. Ensure that the withdrawal of consent is processed promptly and that individuals are notified of the outcome.
    5. Consent Records:
      1. Maintain detailed records of all consents obtained, including the date, time, method, and purpose of consent.
      2. Keep records of any changes or updates to consent preferences.
      3. Ensure that consent records are securely stored and easily accessible for audit purposes.
    6. Regular Consent Reviews:
      1. Conduct regular reviews of consent records to ensure they are accurate and up-to-date.
      2. Identify any expired or invalid consents and take appropriate action, such as seeking renewed consent.
    7. Staff Training:
      1. Provide training to employees who are responsible for obtaining consents.
      2. Educate staff on the importance of obtaining valid consent and the requirements under POPIA.
      3. Ensure that staff are aware of their responsibilities regarding consent management.
    8. Consent Notifications:
      1. Provide individuals with clear notifications when their consent is required.
      2. Clearly state the purpose of the notification and provide options for individuals to provide or withhold consent.
    9. Privacy Notices:
      1. Include information about the organization’s consent practices in privacy notices.
      2. Clearly explain how individuals can provide or withdraw consent and their rights regarding their personal information.
    10. Consent Updates:
      1. Regularly update consent forms and notices to reflect any changes in processing purposes or data handling practices.
      2. Notify individuals of any updates to the consent process and provide them with an opportunity to review and update their consent preferences.

    Following these best practices will help organizations ensure that they are obtaining and managing consents in a compliant and transparent manner, in line with POPIA requirements.

    Consent Communication

    Clear & Concise

    Essential when obtaining consent under the Protection of Personal Information Act (POPIA).

    Here are some examples of best practices for ensuring clear and concise consent communication:

    1. Plain Language:
      1. Use plain and simple language that is easy for individuals to understand.
      2. Avoid technical jargon or legal terms that may confuse the individual.
      3. Clearly explain the purpose for which consent is being obtained and how the personal information will be used.
    2. Highlight Key Information:
      1. Use bold or highlighted text to draw attention to important information, such as the purpose of the consent and the types of personal information being collected.
      2. Clearly state any potential risks or consequences of providing or withholding consent.
    3. Short and Specific:
      1. Keep consent communications short and to the point.
      2. Focus on the specific purposes for which consent is being obtained, rather than providing unnecessary details.
      3. Use bullet points or numbered lists to break down information into easily digestible sections.
    4. Use Visual Aids:
      1. Incorporate visual aids, such as icons or images, to help convey information more effectively.
      2. Use diagrams or flowcharts to illustrate how personal information will be processed and shared.
    5. Use of Examples:
      1. Provide real-life examples or scenarios to illustrate how the personal information will be used.
      2. Use case studies or testimonials to demonstrate the benefits of providing consent.
    6. Interactive Formats:
      1. Consider using interactive formats, such as videos or animations, to engage individuals and explain complex concepts.
      2. Provide links to additional information or resources for those who want more details.
    7. Clear Call to Action:
      1. Clearly state what action is required from the individual, such as clicking a button to provide consent.
      2. Use action-oriented language, such as “Click here to consent” or “Submit your consent.”
    8. Multiple Language Options:
      1. If the organization serves a diverse population, provide consent communications in multiple languages.
      2. Ensure that translations are accurate and convey the same information as the original consent communication.
    9. Accessibility Considerations:
      1. Ensure that consent communications are accessible to individuals with disabilities, such as providing alternative text for images or audio versions for those with visual impairments.
      2. Use readable fonts and colors with sufficient contrast for easy readability.
    10. Confirmation and Acknowledgment:
      1. Provide a clear confirmation message after consent has been given, acknowledging receipt and confirming the individual’s choices.
      2. Include contact information for individuals to reach out with questions or concerns about their consent.

    By following these best practices for clear and concise consent communication, organizations can ensure that individuals fully understand the implications of providing their consent and make informed decisions regarding their personal information.

    This helps build trust and transparency in the organization’s data handling practices, in line with POPIA requirements.

    Consents Compliance

    Regular Updates

    Crucial for maintaining compliance with the Protection of Personal Information Act (POPIA) and ensuring that individuals have ongoing control over their personal information.

    Here are some examples of best practices for providing regular updates on consents:

    1. Consent Renewal Reminders:
      1. Send timely reminders to individuals to renew their consents periodically, especially for long-term consent agreements.
      2. Clearly explain the purpose of the renewal and provide easy-to-follow instructions for updating consent preferences.
    2. Consent Expiry Notifications:
      1. Notify individuals in advance when their consent is about to expire.
      2. Clearly communicate the options available for renewing or updating consent, including any changes to the processing of personal information.
    3. Opt-Out Mechanisms:
      1. Provide individuals with clear and accessible options to opt out of consent at any time.
      2. Ensure that opt-out mechanisms are easy to use and readily available, such as unsubscribe links in email communications or preference management tools on websites.
    4. Preference Management Tools:
      1. Offer individuals the ability to manage their consent preferences through user-friendly online portals or dashboards.
      2. Allow individuals to update their consent preferences, review past consent agreements, and withdraw consent as needed.
    5. Transparency in Changes:
      1. Notify individuals of any material changes to the terms of their consent agreements.
      2. Clearly explain the nature of the changes, the reasons for the changes, and any potential impact on the processing of personal information.
    6. Regular Communication Updates:
      1. Provide regular updates to individuals about how their personal information is being used and processed.
      2. Keep individuals informed about any new purposes for which their information will be used, any changes to data processing practices, and any relevant updates to privacy policies.
    7. Privacy Preference Audits:
      1. Conduct periodic audits of privacy preferences and consent records to ensure compliance with POPIA requirements.
      2. Identify and address any discrepancies or inconsistencies in consent records, and take corrective action as necessary.
    8. Educational Materials and Resources:
      1. Provide educational materials and resources to help individuals understand their rights regarding consent and privacy.
      2. Offer guidance on how to update consent preferences, exercise data subject rights, and protect personal information.
    9. Feedback Mechanisms:
      1. Establish feedback mechanisms for individuals to report concerns or provide feedback about their consent experiences.
      2. Promptly address any inquiries or complaints related to consent management and take appropriate corrective action.

    By implementing these practices for regular updates on consents, organizations can demonstrate their commitment to transparency, accountability, and respect for individuals’ privacy rights under POPIA.

    This helps foster trust and confidence in the organization’s data handling practices and enhances overall compliance with data protection regulations.

    Print Friendly, PDF & Email