POPIA Compliance
IyanaT Production is a division of Adulation Media (Pty) Ltd. This page documents our compliance with the Protection of Personal Information Act, No. 4 of 2013.
Registered with the
Information Regulator of South Africa.
What is POPIA?
The Protection of Personal Information Act, No. 4 of 2013 (POPIA) is South Africa's principal data protection legislation. It gives effect to the constitutional right to privacy by regulating how organisations collect, process, store, and share personal information.
POPIA applies to any entity that processes personal information within South Africa - including private companies, government bodies, and non-profit organisations. As a responsible party under POPIA, Adulation Media (Pty) Ltd (trading as IyanaT Production) is obligated to process personal information lawfully, in a manner that does not infringe on the privacy rights of data subjects.
POPIA came into full effect on 1 July 2021. Our compliance programme was established ahead of that date and is maintained as an ongoing operational standard, not a once-off exercise.
The 8 Conditions for Lawful Processing
POPIA sets out eight conditions that every responsible party must comply with when processing personal information. Below is how we apply each condition in our day-to-day operations:
We have appointed a registered Information Officer who is accountable for ensuring compliance across all processing activities within the organisation.
We collect only the minimum personal information necessary for the purpose at hand. We do not process information beyond what the data subject has consented to or what is required by law.
Personal information is collected for specific, explicitly defined, and lawful purposes. We do not use information for purposes incompatible with the original intent at the time of collection.
We do not process personal information further in a way that is incompatible with the original purpose for which it was collected, without obtaining additional consent.
We take reasonable steps to ensure that the personal information we hold is complete, accurate, not misleading, and updated where necessary.
We maintain transparent documentation of our processing activities and notify data subjects of the nature and purpose of processing at the time of collection.
We implement appropriate technical and organisational measures to secure personal information against unauthorised access, disclosure, loss, or destruction.
We respect and facilitate the rights of data subjects to access, correct, and object to the processing of their personal information, and we respond to requests within the prescribed timeframes.
Our Compliance Commitments
Our POPIA compliance programme is built around operational standards that govern how personal information is handled at every stage of the client relationship:
All personal information is collected with the informed consent of the data subject, or on another lawful basis clearly documented at the time of collection. Consent forms are retained as part of our project records.
For event and portrait photography, we prepare written consent forms and model release documents aligned with POPIA requirements. Corporate clients are supported in obtaining event-wide consent from attendees.
Personal information and media files are stored using encrypted, access-controlled systems. Staff and contractors are bound by confidentiality agreements and receive data protection training.
We retain personal information only for as long as the purpose requires, or as mandated by South African law. Client media is held for a minimum of three years for access purposes, then archived or deleted per our retention policy.
We maintain a documented incident response plan. In the event of a data breach, affected data subjects and the Information Regulator are notified as soon as reasonably possible, in accordance with POPIA Section 22.
Where we engage operators (service providers) who process personal information on our behalf, we ensure data processing agreements are in place that bind those operators to POPIA-equivalent standards.
Categories of Personal Information We Process
The table below summarises the categories of personal information processed in the course of our services, the lawful basis for processing, and the retention approach:
| Category | Examples | Lawful Basis | Typical Retention |
|---|---|---|---|
| Client Identifiers | Name, email, phone, company, job title | Contractual necessity / consent | Duration of contract + 5 years |
| Photographic & Video Images | Event photographs, portraits, video recordings | Consent / legitimate interest | Minimum 3 years, per client agreement |
| Audio Recordings | Podcast episodes, interview recordings | Consent | As agreed with client |
| Financial Information | Invoicing details, payment records | Contractual necessity / legal obligation | 7 years (SARS requirement) |
| Website Usage Data | IP address, browser type, pages visited | Legitimate interest / consent (cookies) | Up to 12 months |
| Enquiry & Form Data | Contact form submissions, lead data | Consent / legitimate interest | 12 months from last interaction |
Your Rights as a Data Subject
POPIA grants you the following rights in respect of your personal information held by us:
Request confirmation of whether we hold your personal information and obtain a copy of that information.
Request correction or deletion of inaccurate, irrelevant, excessive, or outdated personal information.
Object to the processing of your personal information on grounds relating to your particular situation.
Withdraw previously given consent at any time.
Lodge a complaint with the Information Regulator of South Africa.
Request the destruction or deletion of your personal information.
Information Officer
Complaints & Escalation
If you believe that we have processed your personal information in violation of POPIA, please contact our Information Officer first. If unresolved, you may escalate to the Information Regulator.
How to Contact Us
For any POPIA-related queries, please contact us at privacy@iyanat.co.za or +27 10 141 2282.
Privacy Policy &
Cookies Policy.
This POPIA statement should be read alongside our full Privacy Policy and Cookies Policy.