Role Players & Responsibilities

What is the main difference between a Responsible Party and a Operator? Why are those differences important, and what are the responsibilities for each role under POPIA?

There is still a bit of confusion in understanding the essential differences between the Responsible Party and the Operator. We will compare those roles in order to truly understand what your obligations are and ensure you achieve POPIA compliance.

Understanding these differences is crucial in the compliance program since it will affect your responsibilities under POPIA.

Who is a Responsible Party?

Responsible Party is a natural person, legal entity, organisation, company, agency, or any other institution that alone or jointly with other Responsible Partys define the purpose and means of Personal Information processing.

Despite the fact that POPIA describes the Responsible Party in these broad terms, twe can recognize 3 main building blocks when it comes to defining who is the Responsible Party:

• the personal aspect (“the natural or legal person, public authority, agency or any other body”)
• the possibility of pluralistic control (“which alone or jointly with others”)
• the essential elements to distinguish the Responsible Party from others  (“determines the purposes and the means of the processing of Personal Information”)

Responsible Party is the one who determines the purpose and means of the processing (not the Operator). That is why the Responsible Party holds all of the responsibilities and obligations under POPIA.

Who is Operator

Operator is the legal or natural person, organisation, agency, authority, or institution which processes Personal Information on behalf of the Responsible Party.

Usually, the Operator is a third-party company chosen by the Responsible Party to process the Personal Information. Operator does not own the Personal Information, does not define the purpose of the processing or the means in which Personal Information will be used, and answers to the Responsible Party.

The existence of a Operator depends on decisions taken by the Responsible Party. The Responsible Party can decide either to process Personal Information within the organisation or to delegate processing activities to an external organisation.

Two basic conditions for qualifying as a Operator are a separate legal entity with respect to the Responsible Party and processing Personal Information on his behalf.

Co-Responsible Party

In a situation where there are two or more entities, organisations, or companies that jointly determine the purpose and means of processing, POPIA considers them to be Co-Responsible Partys.

As a Co-Responsible Party, you should determine individual responsibilities for compliance with the POPIA obligations in a transparent manner.

In particular, regarding the exercising of the rights of the data subject and the duty to provide the information referred to in section 18 of POPIA. However, each Responsible Party remains responsible for complying with all the obligations under POPIA.

What is the main difference between a Responsible Party and a Operator? Why are those differences important, and what are the responsibilities for each role under POPIA?

There is still a bit of confusion in understanding the essential differences between the Responsible Party and the Operator. We will compare those roles in order to truly understand what your obligations are and ensure you achieve POPIA compliance.

Understanding these differences is crucial in the compliance program since it will affect your responsibilities under POPIA.

Who is a Responsible Party?

Responsible Party is a natural person, legal entity, organisation, company, agency, or any other institution that alone or jointly with other Responsible Partys define the purpose and means of Personal Information processing.

Despite the fact that POPIA describes the Responsible Party in these broad terms, twe can recognize 3 main building blocks when it comes to defining who is the Responsible Party:

• the personal aspect (“the natural or legal person, public authority, agency or any other body”)
• the possibility of pluralistic control (“which alone or jointly with others”)
• the essential elements to distinguish the Responsible Party from others  (“determines the purposes and the means of the processing of Personal Information”)

Responsible Party is the one who determines the purpose and means of the processing (not the Operator). That is why the Responsible Party holds all of the responsibilities and obligations under POPIA.

Who is Operator

Operator is the legal or natural person, organisation, agency, authority, or institution which processes Personal Information on behalf of the Responsible Party.

Usually, the Operator is a third-party company chosen by the Responsible Party to process the Personal Information. Operator does not own the Personal Information, does not define the purpose of the processing or the means in which Personal Information will be used, and answers to the Responsible Party.

The existence of a Operator depends on decisions taken by the Responsible Party. The Responsible Party can decide either to process Personal Information within the organisation or to delegate processing activities to an external organisation.

Two basic conditions for qualifying as a Operator are a separate legal entity with respect to the Responsible Party and processing Personal Information on his behalf.

Co-Responsible Party

In a situation where there are two or more entities, organisations, or companies that jointly determine the purpose and means of processing, POPIA considers them to be Co-Responsible Partys.

As a Co-Responsible Party, you should determine individual responsibilities for compliance with the POPIA obligations in a transparent manner.

In particular, regarding the exercising of the rights of the data subject and the duty to provide the information referred to in section 18 of POPIA. However, each Responsible Party remains responsible for complying with all the obligations under POPIA.