Advocate Pansy Tlakula, chairperson of the Information Regulator.

The Information Regulator in SA published the final Protection of Personal Information (POPI) regulations on 14 December 2018.

Law firm Michalsons notes the regulations say: "These regulations shall be called the regulations relating to the protection of personal information, 2018."

The POPI Act was signed by the then president Jacob Zuma on 19 November 2013 and published in the Government Gazette on 26 November 2013.

The purpose of the POPI Act is to ensure all South African institutions conduct themselves in a responsible manner when collecting, processing, storing and sharing another entity's personal information by holding them accountable should they abuse or compromise personal information in any way.

On 10 May 2016, the Portfolio Committee on Justice and Correctional Services shortlisted five candidates for the office of Information Regulator.

On 17 May 2016, former IEC chairperson, advocate Pansy Tlakula, was recommended as chairperson of the newly formed Information Regulator, and her appointment was confirmed by the president on 26 October 2016.

Also on 26 October 2016, the president, in terms of section 39 of the POPI Act, and on the recommendation of the National Assembly, appointed members of the Information Regulator with effect from 1 December 2016.

Commenting on the latest developments, Michalsons says: "For those who were hoping that these POPI regulations were going to provide practical guidance on how to comply with the POPI Act, I'm afraid you will be disappointed."

It explains the regulations are only eight pages long (plus 35 pages of forms). According to the law firm, these regulations are largely administrative in nature and do not help organisations to interpret the POPI Act or make it easier for them to comply.

It adds there are no clear controls and the accountability is still left with the responsible party to apply the conditions to their circumstances.

"This is very much in line with what we have been saying for years; the regulations are not going to substantially change what you must comply with," says Michalsons.

"For those who were fearful that the POPI Act regulations were going to create extra compliance requirements, I'm pleased to say you will be relieved. There are very few extra requirements, except for the impact that the forms might have," it adds.

Michalsons notes the POPI Act regulations are final, but will only commence on a date to be determined by the regulator by proclamation in the Government Gazette.

The commencement date of the POPI Regulations will be aligned with the POPI commencement date, it concludes.