A privacy policy is more than a website formality. It should explain the personal information your business collects, how it uses and shares that information, and what rights individuals may exercise. The contracts with the providers handling that information matter just as much.
O’Reilly Law provides privacy policy drafting in South Africa, together with data processing and operator agreements that allocate practical responsibilities between businesses and their suppliers.
Under POPIA, the responsible party determines the purpose and means of processing, while an operator processes personal information on its behalf. Section 21 requires appropriate security obligations to be established through a written contract. A document should reflect the real service relationship, not simply change the labels of a template.
Privacy documents should match forms, systems, marketing practices and employee procedures. We help identify gaps between published statements and operational reality, and draft proportional documents for startups, established companies and professional services businesses.
Where international suppliers or overseas hosting are involved, we can also assess the relevant cross-border transfer provisions.
A template may be a starting point, but it can misdescribe how your business processes information or omit relevant obligations. The final notice should reflect actual practices.
It depends on the relationship and processing undertaken. Where a provider acts as an operator under POPIA, the responsible party must establish appropriate security obligations through a written contract.
No. A privacy notice describes the business’s processing of personal information. A PAIA manual serves separate access-to-information functions, although the two documents may be reviewed together.
A tailored employee or recruitment notice can help explain the distinct categories, purposes and disclosures involved in employment-related processing.
Review them when business operations, suppliers, products or relevant legal requirements change, and periodically as part of your compliance governance.
We draft and review practical privacy notices, operator agreements and data protection clauses for South African businesses.
Related services: POPIA Compliance · Commercial Contracts
This page is general information and not legal advice.
Please complete the following form to get in touch with us.
"*" indicates required fields
