By choosing to continue, you are consenting to the use and functioning of this site as is in accordance with our Privacy Policy.

find an article




06 Apr 2021
BY Ridwaan Boda , Era Gunning AND Rakhee Dullabh

POPIA: the mandatory suspension of processing for credit reporting: a credit crisis in the making?

The Information Regulator has published a Guidance Note on Application for Prior Authorisation, in order to guide responsible parties who are currently or intend to process personal information that is subject to prior authorisation.

Section 57 of the Protection of Personal Information Act, 2013 (“POPIA”) requires that prior authorisation be obtained if that responsible party plans to (among other things) process information for the purposes of credit reporting. To this end, the Guidance Note provides that any credit bureaus registered with the National Credit Regulator or any person processing personal information for credit reporting purposes may apply for prior authorisation.

Unless a Code of Conduct applies to a responsible party, such responsible party must submit its application to the Information Regulator prior to processing or any further processing.

The method for obtaining prior authorisation is set out in section 58 of POPIA, which provides that the relevant information processing must be notified by the responsible party to the Regulator.

Responsible parties may not carry out information processing that has been notified to the Regulator until the Regulator has completed its investigation or until they have received notice that a more detailed investigation will not be conducted. (Responsible parties can however assume a decision in their favour if no response in received from the Regulator within the prescribed time frames.) Under section 114(3), this provision does not apply to processing, which is taking place on the date of commencement of POPIA, until the Regulator determines otherwise by notice in Gazette. On 1 April 2021 by notice in a Gazette the Regulator determined that this provision will commence on 1 July 2021. As such, all processing of personal information for credit reporting purposes by credit bureaus, credit providers and the like will have to stop for around 4 weeks (and possibly up to 13 weeks in case the Regulator decides to conduct a more detailed investigation). To our minds, this may cause havoc in the credit market.

In terms of section 59 of POPIA, failure to obtain prior authorisation is an offence and upon conviction may lead to a fine or to imprisonment for a period not exceeding 12 (twelve) months, or to both a fine and such imprisonment.


Rakhee Dullabh

Technology, Media and Telecommunications | Executive

+27 82 509 6565 


Era Gunning

Banking and Finance | Executive

+27 82 788 0827 


Ridwaan Boda

Technology, Media and Telecommunications | Executive

+27 83 345 1119