People often refer to a DPA and it has two meanings. The first is the data protection authority and the second is the data processing agreement. Some people talk about a computer addendum. This is used when there is an existing agreement and you want to add the required data protection clauses by adding an addendum to the existing agreement. POPIA also prohibits the automated processing of personal data when the person concerned is subject to a decision with legal consequences for the person concerned or which significantly affects the person concerned. There are a few exceptions to this prohibition. In the event of a data breach, POPIA requires an operator to notify the responsible party. The responsible party must then inform the information supervisory authority and the person (s) concerned (s) whose information has been accessed illegally, within a reasonable time after there is a reasonable presumption of data breach. POPIA does not have a deadline for a responsible party to notify the regulator, but this must be done as soon as possible. According to the RGPD, a subcontractor is required to inform the person in charge of the processing in case of data breach. The person in charge of the processing should inform the supervisory authority within 72 hours of the data breach in case of danger to the rights and freedoms of a person concerned. And the person concerned should be informed if such a violation can result in a high risk to his rights and freedoms without undue delay. Popia is different in this respect: the information regulator must be informed of all data protection violations, whether or not there is a high risk to the rights and freedoms of a person concerned.

In addition, the persons concerned must be informed, whether or not there is a high risk to the rights and freedoms of a person concerned, unless the person concerned can be identified or the notification obstructs a criminal investigation. Transfers can be made when the transfer fulfils one or more of the following conditions: (i) the recipient is subject to a law, binding social provisions or a binding agreement offering an adequate level of protection, which effectively respects the principles of appropriate treatment of information that are essentially similar to the lawful treatment conditions in the POPIA (including , if necessary, including, if necessary, the persons concerned, who are legal entities; (ii) the person concerned accepts the transmission; (iii) transmission is necessary for the performance of a contract between the person concerned and the party responsible or for the implementation of pre-contract measures taken at the request of the person concerned; (iv) transmission is necessary for the conclusion or execution of a contract between the manager and a third party in the interest of the person concerned; or v) transmission is in the person`s favour and it is reasonable to obtain the consent of the person subject to transmission, but if it were, the person concerned would be likely to grant it.