Data Processing Policy for 3rd Parties

Experian South Africa (Pty) Ltd (“Experian”) Processes Personal Information of both natural and juristic entities in accordance with POPIA, and Experian is committed to complying with POPIA and the conditions for the lawful Processing of Personal Information. Experian is a registered consumer credit bureau with the National Credit Regulator (with registration number: NCRCB16). Experian furthermore operates as a commercial bureau, a full data hosting bureau, and is a member of the Credit Bureau Association (“CBA”), the South African Credit Risk Reporting Association (“SACRRA”) and the Direct Marketing Association of South Africa (“DMASA”).

Depending on the circumstances, Experian could act as a Responsible Party or as an Operator for purposes of POPIA.

As a registered consumer credit bureau, Experian plays a key role in South Africa’s financial ecosystem, and as a result, we are heavily regulated by various acts of legislation, the core of which is the National Credit Act and its Regulations (“NCA”), as well as POPIA.

The process in terms of which Experian manages consumer credit data is complex, and there are various stakeholders in the industry that play a role in this data management process. These stakeholders include the data providers, the industry associations (including SACRRA), as well as all the credit bureaus in South Africa. In the circumstances where Experian acts as the Responsible Party, it means that Experian has certain responsibilities under POPIA to ensure that the Personal Information is used fairly and lawfully and that it remains protected at all times. In other circumstances, Experian acts as the Operator for its clients (when they request Personal Information from Experian) as well as for data providers (when they submit Personal Information to Experian). Due to this complex environment and because of the sensitive data that Experian Processes (both as a Responsible Party and an Operator), it is critical that all entities who do business with Experian (whether when it request data from, submit data to or process data on behalf of Experian), subscribe to specific standards when either submitting data to Experian or when requesting data from Experian or Processing data on Experian’s behalf.