As the Responsible Party you has the duty to use “only operators providing sufficient guarantees to implement
appropriate technical and organisational measures”, so that processing meets the requirements of the
POPIA – including for the security of processing – and ensures the protection of data subject rights.
The Responsible Party is therefore responsible for assessing the sufficiency of the guarantees provided by the
Operator and should be able to prove that it has taken all of the elements provided in the POPIA into
serious consideration.