Course overview

This course provides an in-depth analysis of Data Processing Agreements (DPAs) under South Africa’s Protection of Personal Information Act (POPIA), focusing on the relationship between responsible parties and operators. It explores the mandatory contractual elements required for compliant data handling, emphasizing accountability, security, and risk mitigation. Participants will examine the DPA template's clauses, attachments, and practical implications, ensuring alignment with POPIA’s eight conditions for lawful processing. Updated with insights from 2025 regulatory guidance and enforcement actions, the course equips learners to customize and implement DPAs effectively.

.

Course objectives

Participants will obtain an understanding of :

1. Differentiate Roles Under POPIA: Distinguish between responsible parties and operators, understanding their obligations.
2. Analyze DPA Clauses: Break down key clauses, including subject matter, duration, processing details, and termination procedures.
3. Assess Risks and Safeguards: Evaluate risks to data subjects’ rights and implement technical/organizational measures.
4. Manage Subcontracting and Audits: Ensure flow-down protections for subcontractors and exercise supervisory rights.
5. Handle Data Lifecycle: Apply rules for data return, deletion, and breach notifications.
6. Customize DPAs: Tailor agreements using attachments for data types, risks, and measures, aligning with service contracts.

Course outline

Participants will learn about:

Module 1: Introduction to POPIA and DPAs

• POPIA Fundamentals: Overview of responsible parties, operators, and the eight conditions for lawful processing.

• DPA Purpose: Role of DPAs in ensuring compliance, accountability, and trust.

• Template Structure: Explore flexibility with checkboxes, fillable sections, and ties to service agreements.

Module 2: Core DPA Clauses (Part 1)

• Clause 1: Subject Matter: Linking DPAs to service contracts for purpose specification (Section 13).

• Clause 2: Duration: Aligning terms with services, including termination and storage limitation (Section 14).

• Clause 3: Order Details: Detailing nature/purpose, data types, data subjects, and trans-border transfers (Sections 9-14, 72).

Module 3: Core DPA Clauses (Part 2)

• Clause 4: Technical/Organizational Measures: Documenting safeguards pre-processing (Section 19).

• Clause 5: Deletion/Return of Data: End-of-contract obligations (Section 14).

• Clause 6: Quality Assurance and Duties: Appointing information officers and ensuring confidentiality (Sections 55, 20).

Module 4: Advanced DPA Clauses

• Clause 7: Subcontracting: Requiring consent and flow-down protections (Section 21).

• Clause 8: Supervisory Powers: Audit and inspection rights (Section 23).

• Clause 9: Infringement Communication: Breach assistance and impact assessments (Sections 19-22).

• Clause 10: Instructions Authority: Following directives and flagging unlawful ones (Section 21).

• Clause 11: Data Handling at Termination: Secure deletion/return (Section 14).

Module 5: DPA Attachments and Practical Implementation

• Attachment 1: Data Types: Limiting to necessary categories for minimality (Section 10).

• Attachment 2: Risk to Rights: Assessing impacts on data subjects (Section 5).

• Attachment 3: Measures: Detailing controls for integrity and confidentiality (Section 19).

• Customization and Enforcement: Tailoring DPAs, legal reviews, and lessons from 2025 actions.

Module 6: Building Compliance Culture

• Accountability and Transparency: Documentation and risk mitigation.

• Ongoing Vigilance: Updates for high-risk processing and prior authorizations.

• Ethical Implications: Fostering trust in data ecosystems.