ENS Africa Executive in the Dispute Resolution Department, Nicole Gabryk says "no, you don’t really". “Consent is not the only basis for processing personal information,” explains Gabryk in her conversation with the OFM Business Hour.

She says you do not necessarily need consent to process general information, like one's name, ID number and cell phone number, you do, however, need a lawful reason to process said information. However, when you process special personal information like race, biometrics etc. then the game changes and you do need consent. WhatsApp groups therefore do not require consent from members in order to justify their existence essentially. Gabryk does, however, recommend that WhatsApp group administrators should recreate groups and send out invitations to prospective members so that they understand what the group is about and can edit their own privacy settings accordingly.

She further explains that one of the requirements of POPI is openness or transparency with data subjects regarding what is done with personal information. And that is done by way of a privacy statement or policy that is availed to data subject on websites etc. So there is no need for businesses to send their privacy policy statement to all subjects via email. All they have to do is ensure that it is publicly available. These are but a few of the misinterpretations that have emanated from last week’s commencement date for the outstanding provisions of the Act.