LEGAL

POPIA and GDPR

Last updated 26 August 2026. Our position under South African and European data protection law, your rights under each, and what we do not claim.

1. Purpose of this statement

The Privacy Policydescribes what this website collects and why. This statement sits alongside it and describes the legal framework we work within: the Protection of Personal Information Act 4 of 2013 (“POPIA”) in South Africa, and the United Kingdom and European General Data Protection Regulation (“GDPR”) for engagements that fall within its reach.

It is written for two audiences: someone who submitted a form on this site and wants to know their rights, and a prospective client or prime contractor carrying out due diligence before an engagement.

2. The two roles we occupy

Which obligations apply to us depends on whose decision the processing serves, and we occupy a different role in each case.

  • Our own website and business. For enquiries submitted through this site and for our own client records, we decide why and how the information is processed. That makes us the responsible party under POPIA and the controller under the GDPR.
  • Inside a client engagement. Where a client instructs us to process personal information as part of a build, the client decides the purpose and we act on their instruction. That makes us an operator under POPIA and a processor under the GDPR. In that role our obligations come from the signed statement of work, master services agreement or data processing agreement, not from this page.

3. POPIA, South Africa

POPIA sets eight conditions for the lawful processing of personal information. Accountability. Processing limitation. Purpose specification. Further processing limitation. Information quality. Openness. Security safeguards. Data subject participation. Our practice is built to meet them, and the design of this website is part of that: we collect the minimum a reply requires, we state the purpose at the point of collection, and we do not repurpose enquiry data for marketing or model training.

Your rights under POPIA

As a data subject under section 5 of POPIA you have the right to:

  • be notified that we are collecting your information, and if it has been accessed without authorisation;
  • ask us to confirm, free of charge, whether we hold information about you, and to request a copy of it;
  • request that we correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
  • object to the processing, on reasonable grounds;
  • not have your information processed for direct marketing by unsolicited electronic communication, beyond what section 69 permits;
  • not be subject to a decision based solely on automated processing that has legal consequences for you;
  • complain to the Information Regulator; and
  • bring civil proceedings over an interference with your information.

A formal request for access is made under the Promotion of Access to Information Act, but you do not need to start there. Email us and we will handle a straightforward request without requiring a form.

Information Officer and complaints

Our Information Officer is Rainier Potgieter, contactable at info@singlesource.co.za.

If we do not resolve a complaint to your satisfaction, you may complain to the Information Regulator (South Africa), whose details are published at inforegulator.org.za. You do not need our permission to do that, and you can go to the Regulator directly.

4. GDPR, United Kingdom and Europe

We work with clients in the United Kingdom and Europe. Where a client engagement involves personal information of people in the UK or the EEA, the GDPR is engaged and we contract for it explicitly: the applicable data processing terms are agreed in writing before processing begins, and they set out the scope, the duration, the security measures and the sub-processors.

Your rights under the GDPR

Where the GDPR applies to you, you have the right to:

  • access the personal data we hold about you (Article 15);
  • have inaccurate data rectified (Article 16);
  • have data erased in the circumstances the Regulation specifies (Article 17);
  • restrict processing (Article 18);
  • receive your data in a portable format (Article 20);
  • object to processing carried out on the basis of legitimate interest (Article 21);
  • not be subject to solely automated decision-making with legal or similarly significant effects (Article 22);
  • withdraw consent at any time where consent is the basis (Article 7(3)); and
  • lodge a complaint with a supervisory authority (Article 77).

In the United Kingdom the supervisory authority is the Information Commissioner’s Office at ico.org.uk. In the EEA it is the authority in your country of residence or work.

Transfers to South Africa

We are established in South Africa, so contacting us moves your information there. South Africa is not currently the subject of a UK or European adequacy decision. Where a UK or EEA client engagement requires personal data to be transferred to us, the transfer is governed by the safeguards agreed in that engagement’s contract, which is the mechanism the Regulation provides for exactly this situation.

5. What we do not claim

We would rather be precise here than reassuring. Being precise is the more useful of the two during due diligence.

  • We describe ourselves as GDPR-aware, not GDPR-certified. There is no general certification we hold, and any supplier who tells you otherwise about themselves is worth a second question.
  • POPIA compliance is our baseline for South African work. That is a statement about how we build and operate, not a claim to have been audited by the Information Regulator.
  • This page is a statement of practice. It is not legal advice, and it does not replace the data protection terms in a signed engagement contract, which govern where the two differ.

6. Breach notification

If personal information under our control is accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovering it. Where the GDPR applies, Articles 33 and 34 impose their own timeline, including notification to the supervisory authority within 72 hours where the breach is likely to result in a risk to people’s rights. Where we act as an operator or processor for a client, we notify that client without undue delay so they can meet their own obligation.

7. Exercising a right

Write to info@singlesource.co.za and say what you want. We will acknowledge it, may ask for enough information to confirm who you are, and will respond within 30 days. There is no charge for a request, and we will tell you plainly if a right does not apply in your circumstances rather than letting the request go quiet.