Tata Africa takes the protection of personal information seriously and aims to comply with POPIA.

1. This Personal Information Sharing Policy (the policy) applies to all staff working for Tata Africa which includes all permanent and temporary staff, contractors, and agency workers who are subject to the conditions and scope of this policy. This policy is in addition to other requirements which may be necessary for specific operations and it is your responsibility to familiarise yourself with this policy.
2. “Personal information” means any information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person. Personal information includes, for example, names and addresses, e-mail addresses, recruitment details, financial history and the like. It also includes opinions about individuals as well as facts and also applies to corporate contacts.
3. “Special personal information” is information such as religious or philosophical beliefs, race or ethnic origin, trade union membership, political opinions, health, sexual life or criminal behaviour.

1. Purpose definition and limitation
1. Personal information can only be collected and further processed for lawful, specific and explicitly defined purposes related to a function or activity of Tata Africa.
2. You will find an indication of such purposes in Tata Africa Protection of Personal Information Policy and website privacy policy.
3. After personal information has been collected by Tata Africa it cannot be processed for purposes which are incompatible with the original ones.
4. For example, this means that personal information processed by the HR department for HR purposes will likely not be able to be lawfully processed by the marketing department for marketing purposes.
2. Personal information to be kept confidential
1. Tata Africa must keep personal information confidential and safe from undue disclosures.
2. That means that sharing personal information with an external third party is an exception to the confidentiality rule, and must be analysed in detail to ensure lawfulness, notably considering:
1. Whether the purpose for which the external third party requires the personal information is compatible to the original purpose for which the information was collected;
2. Whether sharing the personal information with the external third party will constitute a transborder flow of information; and
3. Whether sharing the personal information with the external third party will likely put the information at risk due to the poor security measures the third party has in place.

1. If you receive a request for personal information you must: (a) notify the IO who will guide you or, as the case may be, lead the procedures; and follow the flowchart attached as Appendix A.
2. If you are required to share personal information, you must consider whether the personal information is to be shared internally (i.e. within Tata Africa) or externally (i.e. with an agent, a public authority, an unconnected third party or other entities within Tata Africa). When you are certain of the type of request you received, please check the flowchart for guidance on the specific steps to take.
3. If you are unsure which category the personal information sharing falls into, please contact the IO for further advice.
4. You should document at all times any questions asked, answers given and authorisation gained by any parties involved when dealing with a personal information sharing request.
5. Where you are asked to share personal information with unconnected third parties / public authorities, the IO will handle the process himself/herself.

Personal information relating to clients should not be shared with third parties, without seeking further guidance from the IO.

It is essential that all staff comply with all relevant parts of this policy. Any failure to comply with this policy could have serious consequences for Tata Africa and its employees. Failure to comply may lead to: disciplinary action, including summary dismissal (without notice or a payment in lieu of notice) for serious or repeated breaches; civil or criminal proceedings; and/or personal liability for those responsible.

This policy has been reviewed and approved by the IO, and is subject to change without prior notice.

Name: Paul Edwards
Address: 39 Ferguson road, Illovo, Sandton, Johannesburg, 2196
E-mail address: paul.edwards@tatainternational.com
Telephone number: 0114591700
Fax number: