Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998
88
No. 37067
GOVERNMENT GAZETTE, 26 November 2013
Act No. 4 of 2013
Protection of Personal Information Act, 2013
88
Assessment
89. (1) The Regulator, on its own initiative, or at the request by or on behalf of the
responsible party, data subject or any other person must make an assessment in the
prescribed manner of whether an instance of processing of personal information
complies with the provisions of this Act.
5
(2) The Regulator must make the assessment if it appears to be appropriate, unless,
where the assessment is made on request, the Regulator has not been supplied with such
information as it may reasonably require in order to—
(a) satisfy itself as to the identity of the person making the request; and
(b) enable it to identify the action in question.
10
(3) The matters to which the Regulator may have regard in determining whether it is
appropriate to make an assessment include—
(a) the extent to which the request appears to it to raise a matter of substance;
(b) any undue delay in making the request; and
(c) whether or not the person making the request is entitled to make an application 15
in terms of section 23 or 24 in respect of the personal information in question.
(4) If the Regulator has received a request under this section it must notify the
requester—
(a) whether it has made an assessment as a result of the request; and
(b) to the extent that it considers appropriate, having regard in particular to any 20
exemption which has been granted by the Regulator in terms of section 37
from section 23 or 24 applying in relation to the personal information
concerned, of any view formed or action taken as a result of the request.
Information notice
90. (1) If the Regulator—
(a) has received a request under section 89 in respect of any processing of
personal information; or
(b) reasonably requires any information for the purpose of determining whether
the responsible party has interfered or is interfering with the personal
information of a data subject,
the Regulator may serve the responsible party with an information notice requiring the
responsible party to furnish the Regulator, within a specified period, in a form specified
in the notice, with a report indicating that the processing is taking place in compliance
with the provisions of the Act, or with such information relating to the request or to
compliance with the Act as is so specified.
(2) An information notice must contain particulars of the right of appeal conferred by
section 97, and—
(a) in a case falling within subsection (1)(a), a statement that the Regulator has
received a request under section 89 in relation to the specified processing; or
(b) in a case falling within subsection (1)(b), a statement that the Regulator
regards the specified information as relevant for the purpose of determining
whether the responsible party has complied, or is complying, with the
conditions for the lawful processing of personal information and the reasons
for regarding it as relevant for that purpose.
(3) Subject to subsection (5), the period specified in an information notice must not
expire before the end of the period within which an appeal can be brought against the
notice and, if such an appeal is brought, the information need not be furnished pending
the determination or withdrawal of the appeal.
(4) If the Regulator considers that the information is required as a matter of urgency,
it may include in the notice a statement to that effect and a statement of its reasons for
reaching that conclusion, and in that event subsection (3) does not apply.
25
30
35
40
45
50