Payments glossary
POPIA
POPIA - the Protection of Personal Information Act, 2013 - is South Africa's data protection law. It sets eight conditions for how organisations may collect, store, use and share personal information, and it is enforced by the Information Regulator of South Africa.
What POPIA requires
POPIA's eight conditions boil down to discipline: collect the minimum personal information needed for a stated purpose, keep it accurate and secure, do not reuse it for something else, do not keep it longer than needed, and let people see, correct and object to what you hold about them. The Act applies to virtually every organisation processing personal information in South Africa, and the Information Regulator of South Africa enforces it.
POPIA and payment data
Payment flows are dense with personal information - names, contact details, account numbers, card numbers, purchase histories. The practical strategy is minimisation: the less a merchant stores, the smaller the obligation and the smaller the breach surface. Tokenisation is the clearest example, replacing stored card numbers with tokens that are useless if stolen. When a compromise does happen, POPIA requires notifying the Regulator and the affected data subjects.
Where a payment provider fits in
Merchants remain responsible parties, but a serious provider carries the heaviest technical load. LekkaPay processes cardholder data as a PCI DSS Level 1 compliant service provider, which supports the security safeguards merchants are obliged to maintain under POPIA.
Frequently asked questions
Does POPIA apply to payment data?
Yes. Names, contact details, bank account and card numbers are all personal information. The merchant is usually the responsible party deciding why data is processed, while a payment provider commonly acts as an operator processing it on the merchant's behalf - both carry obligations.
How does POPIA relate to PCI DSS?
POPIA is law and covers all personal information; PCI DSS is a contractual card-industry standard covering card data specifically. Meeting PCI DSS supports POPIA's security safeguards condition, but it does not satisfy the rest of the Act - purpose limitation, consent and data subject rights still apply.
What happens if an organisation breaches POPIA?
The Information Regulator can investigate, issue enforcement notices and impose administrative fines of up to R10 million; certain offences also carry criminal liability. Security compromises must be reported to the Regulator and to affected data subjects.
Last updated:
Payments without the jargon.
One integration, every way Africa pays - we'll handle the acronyms.