Facebook Ads Agency Africa journal
Check POPIA before uploading customer lists to an overseas ad platform
Many advertising tools let a business upload a customer list so the platform can find matching accounts. The idea is simple, but the data involved is personal information, and the platform is often based outside South Africa. The Protection of Personal Information Act has rules on purpose, notification and cross-border transfers that apply before any upload.
By Facebook Ads Agency Africa editorial · · 2 min read
Check the original purpose
POPIA requires personal information to be collected for a specific, explicitly defined and lawful purpose, and further processing must be compatible with that purpose. If customers gave their email addresses to receive invoices, using the list for advertising audiences may not be compatible with what they were told.
Section 18 also requires businesses to take reasonably practicable steps to make people aware of matters such as the purpose of collection, the recipients and any planned transfer to another country with the level of protection there. Review your privacy notice and sign-up wording with that in mind.
Test the transfer conditions
Section 72 allows personal information to be transferred to a third party in a foreign country only on certain grounds. These include the recipient being subject to a law, binding corporate rules or a binding agreement giving adequate protection substantially similar to POPIA, the person's consent, necessity for a contract with the person, or a contract concluded in the person's interest. A further ground covers transfers that benefit the person where consent is not reasonably practicable and they would likely give it.
Read the platform's data processing terms to see which ground you are relying on, and record your reasoning.
Upload less, and keep control
Send only the fields the matching feature needs, remove people who have objected to marketing, and keep a record of what was uploaded and when. Agree who in the business may upload lists, and delete audiences you no longer use. This article explains the questions to ask; take legal advice for your specific situation.
- Confirm the list's original purpose allows advertising use.
- Update privacy notices to mention overseas transfers.
- Identify the section 72 ground you rely on.
- Upload only the fields the feature needs.
- Exclude people who objected and log every upload.