POPIA Compliance in Credit Risk Management
Shared Responsibilities Between Trade Shield and Clients ⓘ Reference Article
It is the responsibility of both Trade Shield and our Clients to process personal information lawfully, in accordance with the Protection of Personal Information Act (POPIA), 2013. Trade Shield provides configurable tools and guidance to assist Clients in collecting the necessary legal justification for processing their buyers' personal information. However, the ultimate responsibility for ensuring appropriate justification is in place rests with the Client.
ⓘ Also Available: This article can also be viewed on our WIKI site at wiki.tradeshield.ai/en/governance/popia/justification
In this article
Justification Mechanisms
Trade Shield uses the following mechanisms to obtain justification — both for ourselves and on behalf of our clients:
| CONSENT |
|
| CONTRACT |
|
⚠ Note: Consent is not the primary method of justification as it can be revoked. It is in the client's interest — and we expect it — that buyer contracts include conditional permission bound to the account as primary justification.
Important POPIA Resources
Trade Shield POPIA Resources
Important Act References
| Consent justification | Section 11 — Consent, justification, and objection |
| Notification of processing | Section 18 — Notification to data subject |
| Cross-border transfers | Section 72 |
Trade Shield & Client Responsibilities
Under POPIA, both Trade Shield and its clients may act as either the Responsible Party or the Operator, depending on the specific data being processed and its intended use.
| Party | Role | Key Responsibility |
|---|---|---|
| Client | Responsible Party | For personal information collected from buyers and provided to Trade Shield for onboarding, credit risk assessment, or monitoring. Must ensure a valid operator agreement (Section 21) is in place. Responsible for obtaining a signed Data Processing Agreement. |
| Trade Shield | Responsible Party | For personal information generated or acquired independently — e.g., derived credit insights, enriched risk data, aggregated behavioural indicators, or third-party data from authorised sources. When shared back with the Client, Trade Shield does so under its own obligations. |
Both parties are expected to:
| ✓ Ensure lawful justification for processing data (contract, consent, legitimate interest) |
| ✓ Provide data subject notification as required by Section 18 |
| ✓ Be transparent about what data is collected, why, who it will be shared with, and how it will be stored |
| ✓ Maintain operator agreements and safeguards (Section 21) |
| ✓ Respect data subject rights — access, correction, objection, and deletion |
| ✓ Ensure cross-border processing complies with Section 72 of POPIA |
| ✓ Collect only the minimum data necessary for the prescribed purpose (data minimisation) |
| ✓ Keep financial, contact, and registration data accurate and up-to-date |
| ✓ Implement appropriate security safeguards — data encryption, access control, and secure storage |
Consent Requirements
A summary of POPIA requirements for valid consent:
| Requirement | What it means |
|---|---|
| Specific | Clear about what is being consented to |
| Voluntary | Not bundled with unrelated purposes |
| Informed | Includes who, what, why, how, and where |
| Revocable | Must include a mechanism to withdraw consent |
| Explicit Action | An active step is required — e.g., a tick box or signed document |
| Time-bound | Should have expiry set by time or by purpose/justification where necessary |
| Pre-collection | Consent must be received before obtaining sensitive information from the buyer |
ⓘ Client Requirement: Your privacy policy must include the information a data subject needs to request changes, revoke consent, and lodge a complaint with the Information Regulator.
Consent to Process Personal Information (Template)
The following input is required from the Client to configure consent collection:
| Client Legal Name of Business | Full registered entity name |
| Client Legal Registered Address | Registered physical address |
| Purpose for Processing | e.g., Customer Onboarding / Credit Application / Due Diligence |
| Privacy Policy URL | Must be publicly available |
| Other Entities with Data Access | Apart from Trade Shield — from the client's side |
| Additional Personal Information | Categorical list of "other" personal information not included in the default digital application |
Consent Template Text
{Customer Name}, located at {Customer Address}, requires your consent to collect and process your personal information in connection with {Customer Purpose}. Trade Shield (Pty) Ltd, located in Woodmead, Johannesburg, requires your consent to collect and process your personal information for Credit Risk Insights, Credit Assessments, Financial Analysis, and Due Diligence as part of the application and ongoing monitoring should your application be approved on behalf of {Customer Name}.
This consent applies to your data as it appears in this application, as well as any corrections you make before submission. Additionally, credit reports and checks from authorised sources, such as credit bureaus and Credit Resellers, may be requested during the process.
The information collected may include your contact details, business registration data, financial information, credit history, bank statement analysis, Audited Financials, Credit Reports, and any additional information provided below.
Your personal information may be shared with trusted third parties within the boundaries of the described purpose. Where legally permitted, your data may be transferred or accessed outside of South Africa, in accordance with Section 72 of POPIA, which includes adequate protection mechanisms, contractual assurances, or recognised jurisdictional adequacy.
If you are a sole proprietor or single director, you explicitly consent to your credit data being accessed as part of this process, including credit reports/checks.
Data shared with the following parties:
| Party | Purpose |
|---|---|
| Inoxico | Commercial credit checks |
| VeriCred | Individual credit checks |
| CreditSafe | International company reports |
| Moody's | Financial health and benchmarking |
| TruID | Verified bank statement analysis |
| {Additional Client-listed Recipients} | {Respective purposes} |
Data subject rights:
| ✓ Request access to personal data held about you |
| ✓ Correct inaccurate or outdated information |
| ✓ Withdraw consent at any time, unless processing is required by law or contract |
| ✓ Lodge a complaint with the Information Regulator of South Africa at www.inforegulator.org.za |
Contract as Primary Justification
Trade Shield clients' contracts with their buyers must reflect lawful grounds for processing personal information. The lawful basis is contractual necessity and legitimate interest, combined with disclosure to third parties.
What the contractual clause must include:
| Element | Detail |
|---|---|
| Purpose | Clearly state personal information will be used for credit risk assessment, credit monitoring, and related financial services |
| Data Subjects & Types | Identify the buyer as the data subject; specify typical data: contact info, payment behaviour, financial data, trade history, CIPC, judgments, etc. |
| Legal Basis | Contractual necessity and legitimate interest in credit risk mitigation |
| Third-Party Disclosure | Include Trade Shield and external financial service providers (credit bureaus) as authorised recipients under the same justification |
| Ongoing Nature | Processing continues for the duration of the credit facility and as long as there is a justifiable business reason |
| POPIA/PAIA Alignment | Reference to compliance frameworks; link to relevant PAIA manuals |
| Data Subject Rights | Right to access, correct, or object to processing, within the limits of the law |
| Retention & Protection | Information stored securely and retained only as long as necessary |
| Consent Clarification | Clarify that consent is not required where processing is based on contract or legitimate interest — but data subject rights are still respected |
Example Contractual Clause
⚠ Important Notice: This is an example only. Trade Shield does not take liability for this recommendation. Each party is responsible for ensuring their specific business context and purpose are properly articulated and approved by their Information Officer and Legal Team. This may need to be supplemented or modified to ensure holistic compliance.
By accepting these terms and conditions, the Buyer acknowledges and agrees that [Client Company Name] may collect, process, and share personal and financial information on the Buyer as necessary to assess and manage the Buyer's creditworthiness and ongoing credit risk profile.
This includes the right to disclose Buyer Information to trusted third-party service providers, including but not limited to Trade Shield (Pty) Ltd and authorised financial institutions, such as credit bureaus, for purposes such as credit risk evaluation, credit limit recommendations, trade behaviour analysis, and related financial services.
The Buyer acknowledges that such processing is necessary to perform the obligations of this agreement and is further justified by the legitimate interest of [Client Company Name] in managing credit risk responsibly.
Buyer Information may include contact information, payment behaviour, financial records, trade references, public registry data (e.g., CIPC), legal judgments, and other relevant indicators.
Processing of this information will continue for as long as the Buyer maintains a credit facility with [Client Company Name], and thereafter only as reasonably required for legal, audit, or credit record-keeping purposes.
All processing will be conducted in compliance with the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA). The Buyer may review the applicable PAIA Manual at [Client PAIA URL] and the PAIA Manual of Trade Shield.
The Buyer retains the right to access their personal information, request corrections, or raise reasonable objections to the processing of their information, subject to applicable law. Where information originates from external or public sources, the Buyer will be supported in addressing inaccuracies at the source.
The Buyer acknowledges that this processing is a condition of receiving and maintaining access to a credit facility, and that consent is not the sole basis for such processing where lawful contractual or legitimate interests apply.
Need more help?
The support team is ready to assist