POPIA Compliance

Effective Date: 1 January 2026  |  Last Updated: January 2026

1. Who We Are

Matshaya Legal Inc is a law firm registered and operating in the Republic of South Africa, with offices in Cape Town. As a responsible party under POPIA, we determine the purpose and means of processing personal information in the course of providing legal services and operating this website.

2. Information Officer

We have appointed a designated Information Officer as required by POPIA:

The Information Officer is responsible for ensuring that Matshaya Legal Inc complies with the conditions for lawful processing of personal information as set out in POPIA.

3. The Eight Conditions for Lawful Processing

We adhere to the eight conditions for lawful processing under POPIA:

• Accountability — We take full responsibility for the personal information under our control and ensure compliance at all levels of our practice.
• Processing limitation — We collect only the personal information that is adequate, relevant and not excessive for the purposes for which it is collected.
• Purpose specification — Personal information is collected for a specific, explicitly defined and lawful purpose related to our legal services.
• Further processing limitation — We do not process personal information in a manner incompatible with the original purpose of collection.
• Information quality — We take reasonable steps to ensure that personal information we hold is complete, accurate and not misleading.
• Openness — We maintain this POPIA statement and Privacy Policy to inform data subjects of how their information is processed.
• Security safeguards — We implement appropriate technical and organisational measures to protect personal information from loss, damage or unauthorised access.
• Data subject participation — We respect and uphold the rights of data subjects to access, correct and object to the processing of their personal information.

4. What Personal Information We Process

In the course of operating our website and providing legal services, we may process:

• Full name and identity information
• Contact details (email address, phone number)
• Matter-related information provided during legal consultation
• Technical data collected automatically by our web server

We do not process special personal information (as defined in Section 26 of POPIA) without explicit consent, unless required by law.

5. Data Subject Rights

As a data subject, you have the following rights under POPIA:

• Right to access — You may request a record of the personal information we hold about you
• Right to correction or deletion — You may request that we correct or delete inaccurate, irrelevant or excessive personal information
• Right to object — You may object to the processing of your personal information on reasonable grounds
• Right to complain — You may lodge a complaint with the Information Regulator if you believe we have violated POPIA

6. The Information Regulator

You have the right to lodge a complaint with the Information Regulator of South Africa:

7. Operator Agreements

Where we engage third-party operators to process personal information on our behalf (e.g. email service providers), we ensure that appropriate operator agreements are in place in accordance with Section 21 of POPIA.

8. Security Incidents

In the event of a security compromise involving personal information, we will notify the Information Regulator and affected data subjects as required by Section 22 of POPIA, without unreasonable delay.

9. Retention and Destruction

We retain personal information only for as long as required by the purpose for which it was collected, our legal obligations, and professional rules governing the retention of legal records. When personal information is no longer required, we will destroy or de-identify it in a secure manner.

10. Updates to This Statement

This POPIA Compliance Statement will be reviewed and updated as required. The effective date above reflects the most recent revision.

11. How to Contact Us

To exercise your rights, submit an access request (PAIA Form 2), or raise a data protection concern, please contact our Information Officer: