POPIA Policy

Last Updated: 31 March 2025

1.     Policy Declaration

This policy sets out the requirements for protecting personal information within Cape Town Tourism (CTT) in compliance with the Protection of Personal Information Act (POPIA).

2.    Purpose

The purpose of this policy is to ensure that personal information is processed in a lawful, fair, and transparent manner, protecting the privacy of individuals and ensuring compliance with POPIA.

3.    Scope

This policy applies to all employees, contractors, consultants, temporaries, and other workers at CTT who handle personal information.

4.    Principles

• Lawfulness, Fairness, and Transparency: Process personal information lawfully, fairly, and transparently.
• Purpose Limitation: Collect personal information for specified, explicit, and legitimate purposes.
• Data Minimisation: Ensure that personal information collected is adequate, relevant, and limited to what is necessary.
• Accuracy: Ensure that personal information is accurate and kept up to date.
• Storage Limitation: Retain personal information only for as long as necessary.
• Integrity and Confidentiality: Protect personal information against unauthorized access, loss, destruction, or damage.

5.    Objectives and Compliance

• Ensure that personal information is processed in compliance with POPIA.
• Maintain accurate records of personal information processing activities.
• Coordinate with relevant teams to ensure compliance with POPIA guidelines.

6.    Management Commitment

CTT management is committed to aligning personal information processing with the organization's business objectives and ensuring the security and integrity of personal information.

7.    Policy Rules

7.1.Collection of Personal Information

1. Lawful Basis: Collect personal information only on a lawful basis, such as consent, contract, legal obligation, vital interests, public task, or legitimate interests.
2. Purpose Specification: Clearly specify the purpose for which personal information is collected and ensure that it is used only for that purpose.

• Data Minimisation: Collect only the personal information that is necessary for the specified purpose.

7.2.           Processing of Personal Information

1. Lawful Processing: Process personal information in a manner that is lawful, fair, and transparent.
2. Data Accuracy: Ensure that personal information is accurate and kept up to date. Take reasonable steps to rectify or delete inaccurate information.

• Data Security: Implement appropriate technical and organizational measures to protect personal information against unauthorized access, loss, destruction, or damage.

7.3.           Retention and Disposal of Personal Information:

1. Retention Period: Retain personal information only for as long as necessary to fulfill the specified purpose or as required by law.
2. Secure Disposal: Dispose of personal information in a secure manner to prevent unauthorized access.

7.4.           Access to Personal Information:

1. Access Control: Implement access control measures to ensure that only authorized individuals have access to personal information.
2. Data Subject Rights: Respect the rights of data subjects, including the right to access, rectify, delete, and restrict the processing of their personal information.

7.5.          Data Breach Management:

1. Incident Response: Implement procedures for detecting, reporting, and responding to data breaches.
2. Notification: Notify the relevant authorities and affected data subjects in the event of a data breach, as required by law.

7.6.          Training and Awareness:

1. Employee Training: Provide training to employees on their responsibilities regarding the protection of personal information and compliance with POPIA.
2. Awareness Initiatives: Implement ongoing awareness initiatives to reinforce the importance of protecting personal information.

7.7.           Compliance and Monitoring:

1. Compliance Monitoring: Monitor compliance with this policy and relevant legal and regulatory requirements.
2. Audit and Review: Conduct regular audits and reviews of personal information processing activities to ensure compliance with this policy and POPIA.

8.    Non-compliance

Violations of this policy may result in disciplinary actions, including termination of employment or contract.

9.    Review and Revision

This policy will be reviewed annually and revised as necessary to ensure its effectiveness and alignment with CTT's business objectives.

10. Information Officer and Deputy Information Officer

10.1.         Designation and Accountability

Cape Town Tourism (CTT) designates an Information Officer (IO) in accordance with Section 55 of the Protection of Personal Information Act (POPIA), supported by one or more Deputy Information Officers (DIOs) as required. The IO is accountable for ensuring compliance with POPIA and reports to the CEO.

10.2.       Responsibilities of the Information Officer

1. Oversee the implementation and enforcement of this policy and associated procedures.
2. Ensure personal information is processed lawfully and transparently across all departments.

• Maintain the organization’s records of personal information processing activities.

1. Serve as the point of contact with the Information Regulator and respond to data subject complaints.
2. Approve internal training, awareness, and breach response procedures.
3. Lead compliance reviews and submit internal reports to the POPIA Compliance Forum and EXCO.

10.3.       Responsibilities of the Deputy Information Officer(s)

1. Support the Information Officer in executing compliance responsibilities.
2. Act as liaison with specific departments (e.g., HR, IT, Marketing) for operational POPIA implementation.

• Monitor completion of awareness training and assist with DSAR coordination.

1. Escalate privacy incidents or non-compliance issues for IO review.

11.   Document Version Control

Version	Date	Editor	Comments
1.0	2025-03-31	Sulaiman Fredericks	Final version for review and sign-off