The imminent arrival of South Africa's Personal Information (POPI) Act is causing mixed reactions as proponents argue it will enhance trade with countries operating stringent personal information laws while detractors say it will stop domestic firms competing with foreign counterparts like Google, Facebook and Amazon, who are exempt from compliance.
The Act means increased protection of personal information by public and private bodies, including governing the way information such as race, gender, age, credit and employment history is obtained, managed and stored.
POPI is due to be rolled out within the next few weeks following the appointment of a new dedicated officer to oversee its implementation and once the Act becomes law, all South African companies will have a 12-month grace period to fully comply.
According to the government, POPI was brought in to enforce constitutional rights to privacy. However, its focus on data protection legislation is doubtless geared towards opening up new trade with the European Union and US, which both demand strict data protection laws from buyers and sellers.
One South African firm that has already spent around 1 million on POPI compliance is 'The Unlimited' - a financial services business and direct marketing specialist that stands to be hit hard by the changes.
At the same time, one of the big four banks operating in South Africa has reportedly spent around R350 million on IT systems in preparation for POPI.
Compliance is sure to represent a significant cost burden for all businesses, particularly those using direct marketing, by impeding their ability to reach new customers through low-cost electronic marketing like email and SMS.
POPI rules dictate that a company can send one unsolicited email or SMS to a potential customer but that if the recipient does not ‘opt in’ to future communication, further direct marketing is prohibited.
Some direct marketers, credited in South Africa with playing a role in delivering information about products and services to under-served markets, are particularly anxious.
Warren Moss, chairman of the Direct Marketing Association of South Africa said: "A horizontal piece of legislation [such as POPI] cannot be tailored for every industry."
Business leaders and analysts fear the government is going out of its way to protect citizens at the cost of innovation and growth of the economy.
KPMG legal manager Nikki Pennel says “POPI will affect every organisation in South Africa at some level ... to the extent we are re-examining the way we process and secure data".