POPIA Compliance Manual

1. Executive Statement & Statutory Commitment

Gauteng Central College (Pty) Ltd is dedicated to conducting its educational and administrative operations with integrity, transparency, and strict adherence to the Protection of Personal Information Act No. 4 of 2013 (POPIA) and the Promotion of Access to Information Act No. 2 of 2000 (PAIA).

This manual establishes the institutional standards governing how student dossiers, academic records, staff files, bursary evaluations, and guardian records are collected, managed, stored, and audited. Every administrative staff member, educator, and technical contractor operating across our Primary School, High School, and Occupational College divisions is bound by this framework.

2. The 8 Statutory Conditions for Lawful Processing

POPIA prescribes eight distinct conditions with which a Responsible Party must comply when processing personal information. Gauteng Central College implements these conditions as follows:

Condition 1: Accountability (Section 8)

The Institution ensures that all provisions of POPIA are complied with at all stages—from the initial online admission enquiry through to post-graduation certificate verification. The designated Information Officer oversees data protection audits and staff privacy training.

Condition 2: Processing Limitation (Sections 9 to 12)

Processing is lawful, minimal, and directly relevant to educational provision. Information is obtained directly from data subjects (learners, parents, sponsors, or staff). Prior written consent is obtained via digital application agreements or signed hardcopy enrolment contracts.

Condition 3: Purpose Specification (Sections 13 & 14)

Personal information is collected strictly for specified, explicitly defined, and lawful educational purposes. Data subjects are notified of the exact purpose at the point of data capture. Records are retained only for as long as necessary to achieve the stated purpose or satisfy statutory curriculum and taxation requirements.

Condition 4: Further Processing Limitation (Section 15)

Personal data is never processed for secondary purposes incompatible with the original educational admission contract without secondary explicit consent, unless mandated by DHET, QCTO, or criminal law enforcement directives.

Condition 5: Information Quality (Section 16)

GCC takes reasonably practicable steps to ensure that personal records are complete, accurate, not misleading, and updated. Students and guardians can verify and request corrections to their recorded contact information at any time.

Condition 6: Openness & Transparency (Sections 17 & 18)

We maintain detailed documentation of all processing operations. Our Privacy Notices are prominently displayed on our website, digital application portals, and physical enrolment desks.

Condition 7: Security Safeguards (Sections 19 to 22)

GCC secures the integrity and confidentiality of personal information in its possession by taking appropriate, reasonable technical and organizational measures:

• Encrypted data transit (TLS/SSL encryption on all portals);
• Server directory firewalls with `.htaccess` direct access denials on user uploads;
• Separation of duties with Role-Based Access Control (RBAC);
• Mandatory 2FA authentication on supreme root and administrative portals;
• Physical campus security: locked filing repositories for paper dossiers with biometric and monitored access.

Condition 8: Data Subject Participation (Sections 23 to 25)

Data subjects are entitled to request access to their personal records, request the correction of inaccuracies, or request the deletion of records that the Institution is no longer authorized to retain.

3. Protection of Children's Personal Information (Section 35)

Gauteng Central College acknowledges the heightened vulnerability of minors enrolled in our **Primary School (Grades R–7)** and **High School (Grades 8–12)**.

GCC requires parents or legal guardians to execute explicit consent documentation before any student file is created or academic assessment is conducted. Photographs or video recordings of minor learners participating in campus activities are captured and published only with documented parental media consent.

4. Information Officer & Governance Structure

Pursuant to Section 55 and Section 56 of POPIA, the statutory duties of the Information Officer at Gauteng Central College include:

• Promoting compliance with the conditions for lawful processing within the Institution;
• Handling requests made to the Institution pursuant to POPIA and PAIA;
• Liaising with the Information Regulator in relation to investigations or compliance inspections;
• Ensuring institutional operational manuals and staff guidelines are updated annually.

5. Security Incident & Data Breach Protocol (Section 22)

In the event that personal information has been accessed or acquired by an unauthorized person, Gauteng Central College adheres to the mandatory breach protocol mandated by Section 22 of POPIA:

1. Immediate Containment: The Technical Architecture and Infrastructure team isolates the affected server sector and terminates compromised session tokens;
2. Statutory Notification to the Information Regulator: The Information Officer formally notifies the Information Regulator in writing as soon as reasonably possible;
3. Notification to Affected Data Subjects: Impacted learners, parents, or staff members are notified via registered email and direct communications detailing:
   • A description of the possible consequences of the security breach;
   • Measures that GCC has taken to mitigate and resolve the incident;
   • Recommendations to the data subject on protective steps (e.g. credential updates); and
   • Direct contact details of the Information Officer investigating the incident.

6. Operator (Third-Party Service Provider) Agreements

Where GCC utilizes external operators to process data on its behalf (such as cloud server hosts, SMS broadcast networks, or student information system providers), GCC mandates formal, written agreements in terms of Section 21 of POPIA ensuring that:

• The operator establishes and maintains equivalent security safeguards;
• The operator treats all student and institutional information as strictly confidential;
• The operator immediately alerts GCC of any actual or suspected data compromises.

7. Integration with the Promotion of Access to Information Act (PAIA)

This POPIA Manual forms part of Gauteng Central College's comprehensive information governance architecture under PAIA Act No. 2 of 2000.

The PAIA manual detailing categories of records held by GCC (such as Company Incorporation records, Accreditation certificates, Financial statements, Curriculum manuals, and Student rolls) is available for inspection at our physical campus administrative offices during standard business hours (Monday to Friday, 08:00 to 16:30).

8. Data Subject Request Procedure & Submission Form

To request access to, correction of, or deletion of personal information held by Gauteng Central College, please complete the statutory request framework below or send an official written submission to our Information Officer at info@gautengcentralcollege.co.za.