Notice of Privacy Practices

MANDATORY

POPIA requires practices to process personal and special personal information ‘reasonably’ and in an ‘open’ which is ‘easily accessible and easy to understand’. This means that practices must provide information to patients about how the practice processes patient data in the form of practice privacy notices.

It is suggested that a layered approach can be used to inform patients. Practices should display a poster in the waiting room and have their Notice of Privacy Practices available at the front desk if a patient enquire about the privacy notice.

The openness requirements in POPIA apply irrespective of the legal basis for processing and throughout the life cycle of processing. This is clear from section 18(2) in POPIA  which provides that openness applies at the following stages of the data processing cycle:

• before or at the start of the data processing cycle,
• i.e. when the personal information is being collected either from the data subject or otherwise obtained, unless the data subject is already aware of the information referred to in that subsection; or
• in any other case, before the information is collected or as soon as reasonably practicable after it has been collected.