Accountability
The responsible party must ensure that the conditions set out in this Chapter, and all the measures that give effect to such conditions, are complied with at the time of the determination of the purpose and means of the processing and during the processing itself.
What this means for your board
- This is the section that puts personal-information compliance squarely on the trustees'/board's desk, accountability isn't delegable to “whoever handles IT.”
- “At the time of determination of purpose and means” means compliance has to be designed in before you roll out a new CCTV system or visitor app, not patched on afterward.
- For governance purposes, this is the section an auditor or the Information Regulator will point to first if something goes wrong, “who was accountable” starts here.
See where your accountability actually stands with the free POPIA Compliance Status Assessment, a specialist-reviewed snapshot of documented oversight rather than good intentions.
Section 8 puts the duty on the “responsible party”, for an estate or scheme, that's the body corporate/HOA itself, acting through its trustees or directors. It isn't delegable to whoever happens to run IT or the managing agent.
Both. Section 8 requires compliance “at the time of the determination of the purpose and means of the processing and during the processing itself”, meaning it has to be designed in before a new CCTV system or visitor app goes live, not patched on afterward.