Privacy Notice

This Privacy Notice explains how RP Attorneys collects, uses, stores, shares and protects personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable law.

Responsible Party and information officer

RP Attorneys is the responsible party for personal information processed for the purposes of its legal practice and other processing activities for which it determines the purpose and means of processing.

The Information Officer of RP Attorneys is Rulich Pretorius. Questions, requests or objections relating to the processing of personal information may be directed to the Information Officer at:

Email: info@attorney-pretoria.co.za
Telephone: +27 71 3555 950
Location: Pretoria East, Gauteng, South Africa

Address for POPIA and PAIA notices: Available from the Information Officer on request and as set out in RP Attorneys’ PAIA Manual.

Information Processed by RP Attorneys

Depending on the nature of the relationship, enquiry, instruction or matter, RP Attorneys may process personal information including:

  • identification and biographical information, including names, identity or registration numbers and dates of birth;
  • contact information, including telephone numbers, email addresses and physical or postal addresses;
  • financial information, including banking details, payment information, financial circumstances and transaction records;
  • information supplied for purposes of client identification, verification, regulatory compliance and the prevention of financial crime;
  • information relating to legal matters, disputes, transactions, employment relationships, contractual relationships and court or other proceedings;
  • correspondence, documents, instructions and other communications exchanged with RP Attorneys;
  • information concerning third parties where relevant to a legal matter or other lawful purpose;
  • website and electronic information, including information submitted through electronic communications and technical information generated through use of the website; and
  • any other personal information reasonably necessary for the purpose for which it is collected.

RP Attorneys endeavours to collect and process only personal information that is adequate, relevant and not excessive in relation to the purpose for which it is processed.

In the course of providing legal services, RP Attorneys may also process special personal information, personal information relating to children, or information concerning alleged or actual criminal conduct where such processing is necessary and lawful in the circumstances. Such information is processed subject to the additional protections prescribed by POPIA and other applicable law.

Sources of Personal information

RP Attorneys generally collects personal information directly from the data subject. However, where permitted by POPIA or other applicable law, personal information may also be obtained from other sources, including:

  • clients, prospective clients and persons acting on their behalf;
  • opposing parties, legal representatives, witnesses and other persons involved in legal proceedings or disputes;
  • employers, employees, contractors, service providers and other persons relevant to a matter;
  • courts, tribunals, regulatory authorities, government departments and other public bodies;
  • public records, registers and information lawfully available to the public;
  • financial institutions, payment service providers and other institutions involved in transactions relevant to a matter;
  • debt mediators and other parties involved in Debt Mediation arrangements administered by RP Attorneys;
  • and other third parties where collection from that source is authorised, necessary or otherwise permitted by law.

Where personal information is not collected directly from the data subject, RP Attorneys will process such information only where there is a lawful basis for doing so and subject to the requirements of POPIA.

Purposes and Grounds for Processing

RP Attorneys processes personal information only where permitted by POPIA and for legitimate purposes connected with its professional, administrative and regulatory activities. Depending on the circumstances, personal information may be processed where:

  • the data subject has consented to the processing;
  • processing is necessary to enter into, perform or administer an agreement or mandate;
  • processing is necessary to comply with an obligation imposed by law;
  • processing protects or advances a legitimate interest of the data subject;
  • processing is necessary for the proper pursuit of the legitimate interests of RP Attorneys or of a third party to whom the information is supplied; or
  • another lawful ground recognised by POPIA applies.

Personal information may accordingly be processed for purposes including:

  • responding to enquiries and communicating with clients, prospective clients and other persons;
  • opening, administering and managing legal matters and professional mandates;
  • providing legal advice, representation, drafting, dispute-resolution and related legal services;
  • conducting conflict checks and determining whether an instruction can be accepted;
  • client identification, verification and compliance with obligations arising under FICA, professional rules and other applicable legislation;
  • invoicing, accounting, trust-account administration, payments and the collection or distribution of funds;
  • conducting litigation, disciplinary proceedings, negotiations and other legal or administrative processes;
  • managing the practice, maintaining records, securing systems and preventing fraud or misuse;
  • complying with court orders, regulatory requirements, professional obligations and lawful requests from competent authorities;
  • establishing, exercising or defending legal rights or claims; and
  • carrying out Debt Mediation administration falling within RP Attorneys’ limited role as described elsewhere on this website.

RP Attorneys will not process personal information in a manner that is incompatible with the purpose for which it was collected unless such further processing is permitted by POPIA.

Voluntary and Mandatory Information

The provision of personal information to RP Attorneys is generally voluntary. However, certain information may be required in order for RP Attorneys to consider or accept an instruction, provide legal services, administer a mandate, process or distribute funds, comply with professional obligations, or meet requirements imposed by law.

Where the provision of particular personal information is required by law, contract or the nature of the service requested, failure to provide that information may prevent RP Attorneys from accepting or continuing an instruction, performing an agreement, processing a transaction, making or receiving a payment, or providing the requested service.

In particular, RP Attorneys may be required to collect and verify information in order to comply with applicable legislation and professional obligations, including the Financial Intelligence Centre Act 38 of 2001 (“FICA”), where applicable.

Where the provision of information is optional, a data subject may elect not to provide it, although this may limit RP Attorneys’ ability to respond to an enquiry or provide the requested service.

Disclosure and Recipients of Personal Information

RP Attorneys does not sell personal information. Personal information may, however, be disclosed where reasonably necessary for the purpose for which it was collected, for the performance of a professional mandate, for regulatory or legal compliance, or where otherwise permitted or required by law.

Depending on the circumstances, personal information may be disclosed to or processed by:

  • clients, prospective clients and persons authorised to act on their behalf;
  • advocates, correspondent attorneys, experts, consultants, mediators, arbitrators and other professional service providers involved in a matter;
  • courts, tribunals, regulatory authorities, government departments and other competent public bodies;
  • financial institutions, payment service providers, auditors, accountants and other persons involved in financial or trust-account administration;
  • information-technology, hosting, cloud-storage, communications, document-management and other service providers acting on behalf of RP Attorneys;
  • insurers, compliance providers and professional advisers;
  • debt mediators and other parties involved in Debt Mediation arrangements where disclosure is necessary for the administration of those arrangements; and
  • any other person where disclosure is authorised by the data subject, required by law, necessary for the establishment, exercise or defence of legal rights, or otherwise permitted under POPIA.

Where a third party processes personal information on behalf of RP Attorneys as an operator, RP Attorneys requires that party to process the information only with appropriate authority and to maintain reasonable security safeguards.

Cross-Border Transfers

RP Attorneys may, where necessary, make use of service providers, systems or infrastructure that process or store personal information outside the Republic of South Africa.

Where personal information is transferred outside South Africa, RP Attorneys will take reasonable steps to ensure that the transfer complies with section 72 of POPIA. This may include ensuring that the recipient is subject to a law, binding agreement or other arrangement providing an adequate level of protection, obtaining the data subject’s consent where appropriate, or relying on another lawful ground recognised by POPIA.

RP Attorneys will not transfer personal information across borders merely for convenience where such transfer would not comply with applicable data-protection requirements.

Retention and Destruction of Personal Information

RP Attorneys retains personal information only for as long as is reasonably necessary to fulfil the purpose for which it was collected, or for such longer period as may be required or permitted by law, professional obligations, contractual requirements, legitimate business needs, the establishment or defence of legal rights, or the resolution of disputes.

Retention periods may differ depending on the nature of the information and the purpose for which it is processed. In particular, legal matter files, financial records, trust-account records, client-identification information, correspondence and regulatory records may be retained for periods prescribed by legislation, professional rules, accounting requirements or other applicable obligations.

Once personal information is no longer required and there is no lawful basis for its continued retention, RP Attorneys will take reasonable steps to securely delete, destroy or de-identify the information in a manner that prevents its reconstruction or unauthorised use.

Where a data subject validly requests that the processing of personal information be restricted, RP Attorneys will retain the information only to the extent permitted by POPIA while the restriction remains applicable.

Information Security and Security Compromises

RP Attorneys takes reasonable and appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access, interference, modification or disclosure.

Security measures may include access controls, password and authentication measures, secure information systems, appropriate physical safeguards, backups, malware protection, restricted access to records, and reasonable measures aimed at ensuring that service providers and operators protect personal information entrusted to them.

RP Attorneys periodically considers the risks associated with the personal information it processes and takes reasonable steps to maintain and, where appropriate, improve its safeguards.

Where RP Attorneys has reasonable grounds to believe that personal information in its possession or under its control has been accessed or acquired by an unauthorised person, RP Attorneys will investigate the incident and, where required by POPIA, notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to any lawful delay or restriction.

Any operator or service provider processing personal information on behalf of RP Attorneys is required to notify RP Attorneys promptly of any suspected or actual unauthorised access to personal information so that the appropriate response may be taken.

Rights of Data Subjects

Subject to POPIA, PAIA and any other applicable law, a data subject may have the right to:

  • request confirmation of whether RP Attorneys holds personal information about them;
  • request access to personal information held by RP Attorneys, subject to any lawful grounds upon which access may be refused;
  • request the correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
  • request the destruction or deletion of personal information that RP Attorneys is no longer authorised to retain;
  • object, on reasonable grounds and where permitted by POPIA, to the processing of personal information;
  • withdraw consent where consent is the basis upon which particular processing takes place, without affecting processing that occurred lawfully before withdrawal;
  • object to the processing of personal information for purposes of direct marketing;
  • lodge a complaint with the Information Regulator; and
  • exercise any other right afforded to a data subject under POPIA or other applicable law.

Requests relating to personal information may be directed to the Information Officer using the contact details provided in this Privacy Notice. RP Attorneys may require reasonable proof of identity before providing access to or acting upon a request concerning personal information.

The exercise of a data subject right does not necessarily require RP Attorneys to delete, disclose or cease processing information where continued retention, non-disclosure or processing is authorised or required by law, professional obligations, legal privilege, the rights of third parties, or another lawful ground.

Direct Marketing and Website Technology

RP Attorneys does not use personal information for unsolicited electronic direct marketing except where permitted by POPIA. Where consent is required for direct marketing, such marketing will only be undertaken after the appropriate consent has been obtained, and a data subject may object to or withdraw from direct marketing communications in accordance with applicable law.

Where RP Attorneys communicates with an existing client about its own services, any direct marketing communication will be undertaken only to the extent permitted by POPIA and will provide the recipient with an appropriate means of objecting to further marketing communications.

The RP Attorneys website may make use of cookies or similar technologies that are necessary for the proper functioning, security or administration of the website. If additional analytics, advertising or other non-essential tracking technologies are introduced, this Privacy Notice and any applicable consent mechanism may be updated where required.

RP Attorneys does not presently use the website to make decisions about individuals solely by means of automated processing that produces legal consequences or similarly significant effects

PAIA

Requests for access to records held by RP Attorneys may, where applicable, be made in accordance with the Promotion of Access to Information Act 2 of 2000 (“PAIA”) and RP Attorneys’ PAIA Manual.

RP Attorneys’ PAIA Manual contains further information concerning requests for access to records and the procedures applicable to such requests. A copy of the Manual may be requested from the Information Officer.

Complaints and the Information Regulator

A data subject who has a concern about the manner in which RP Attorneys processes personal information is encouraged to raise the matter with the Information Officer in the first instance so that the concern can be investigated and addressed where appropriate.

A data subject also has the right to lodge a complaint with the Information Regulator (South Africa) in accordance with POPIA.

POPIA complaints: POPIAComplaints@inforegulator.org.za
Telephone: 010 023 5200
Toll-free: 0800 017 160

Complaints may also be submitted through the Information Regulator’s electronic complaints services.

Debt Mediation and Personal Information

Where RP Attorneys is involved in the administration of a Debt Mediation arrangement, personal information may be received from the consumer, the relevant debt mediator, financial institutions, payment service providers or other persons involved in the arrangement.

Such information may include identification and contact information, banking and payment information, information relating to deductions and DebiCheck mandates, transaction records, information concerning creditors and financial obligations, correspondence, instructions received from the debt mediator, and other information reasonably necessary for the administration of the arrangement.

RP Attorneys’ role in Debt Mediation is limited as described elsewhere on this website. Where RP Attorneys processes personal information on the instructions of a debt mediator or another responsible party, such processing will be undertaken within the scope of the applicable mandate or authority and subject to POPIA. Where RP Attorneys independently determines the purpose and means of particular processing — including processing required for trust-account administration, accounting, regulatory compliance, legal obligations, record-keeping or the protection of legal rights — RP Attorneys may itself act as the responsible party in respect of that processing.

Personal information relating to Debt Mediation may be disclosed to the relevant debt mediator, financial institutions, payment service providers, beneficiaries of distributions, service providers and other persons where reasonably necessary to administer the arrangement or where disclosure is otherwise authorised or required by law.

Questions or disputes concerning the debt mediator’s own collection, use or processing of personal information should be directed to the relevant debt mediator where that mediator is the responsible party for such processing. This does not affect any rights a data subject may have against RP Attorneys in respect of processing for which RP Attorneys is responsible.

Last updated: August 2026