POPIA Compliance Notice
Protection of Personal Information Act 4 of 2013
Last updated: May 2026
1. Purpose of this notice
This notice explains how Barnard Inc meets its obligations as a responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). It sets out who is responsible for your personal information, what rights you have as a data subject, and how to exercise those rights.
This notice should be read alongside our Privacy Policy, which provides more detail about how we collect, use, store and share personal information when you interact with our website and services.
2. Responsible party
The responsible party for the personal information we process is:
Barnard Inc
Registration number: 1998/018456/21
Physical address: Brooklyn Place Office Park, 266 Bronkhorst Street, Nieuw Muckleneuk, Brooklyn, Pretoria
Email: info@barnardinc.co.za
Phone: +27 (0) 12 001 2739
Website: www.barnardinc.co.za
Barnard Inc is incorporated in terms of the Legal Practice Act 28 of 2014 and is subject to the rules and ethical obligations of the Legal Practice Council, which include duties of confidentiality in respect of client information.
3. Information Officer
Barnard Inc's designated Information Officer, as required by section 55 of POPIA, is:
Douw Breed — Managing Director
Email: info@barnardinc.co.za
Phone: +27 (0) 12 001 2739
The Information Officer is responsible for ensuring that Barnard Inc complies with POPIA, handling requests from data subjects, and liaising with the Information Regulator where required.
4. Personal information we process
Depending on how you interact with us, we may process the following categories of personal information:
- Contact and identification details — name, email address, phone number, company name and role;
- Matter-related information — details you share with us about a legal matter, dispute, transaction or query;
- Website usage information — browser type, device information, pages visited and referring URLs (collected via cookies and analytics tools);
- Communication records — emails, form submissions and chat interactions with our website tools;
- Documents and files — any files you upload or share with us in connection with a legal matter or enquiry.
We do not knowingly process the personal information of minors without the consent of a parent or guardian.
5. Why we process your personal information
We process personal information for the following purposes:
- To respond to enquiries and provide legal services;
- To manage our client relationships and communicate effectively;
- To fulfil our legal and professional obligations, including duties of confidentiality, anti-money laundering (FICA) requirements, and court-related obligations;
- To improve our website and the tools available on it;
- To send relevant updates, resources or information where you have consented or where we have a legitimate interest in doing so.
We process personal information only for the specific purpose for which it was collected. We do not sell, rent or trade your personal information to third parties.
6. Lawful basis for processing
We process personal information on one or more of the following lawful grounds under POPIA:
- Consent — where you have provided consent for a specific purpose;
- Contractual necessity — where processing is required to enter into or perform a contract or to provide legal services;
- Legal obligation — where we are required to process information to comply with applicable law (including FICA, court orders and professional rules);
- Legitimate interest — where we have a legitimate interest in processing that is not overridden by your rights and interests.
7. Your rights as a data subject
Under POPIA, you have the following rights in respect of your personal information:
Right to access
You have the right to request confirmation of whether we hold your personal information and to request access to that information. Requests are governed by the Promotion of Access to Information Act 2 of 2000 (PAIA) and must be made using the prescribed form. Our PAIA Manual is available on request.
Right to correction or deletion
You have the right to request that we correct inaccurate, misleading or outdated personal information. You may also request the deletion or destruction of personal information that we are no longer authorised to retain, subject to any overriding legal or professional obligations.
Right to object
You have the right to object, on reasonable grounds, to the processing of your personal information. You may also object at any time to the processing of your information for direct marketing purposes, and we will stop processing it for that purpose immediately.
Right to withdraw consent
Where we process your information on the basis of consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before the withdrawal.
Right not to be subject to automated decision-making
You have the right not to be subject to decisions taken solely on the basis of automated processing of your personal information where those decisions have a legal or similarly significant effect on you.
8. How to exercise your rights
To exercise any of the rights described above, please contact our Information Officer in writing:
Douw Breed — Information Officer, Barnard Inc
Email: info@barnardinc.co.za
Post: Brooklyn Place Office Park, 266 Bronkhorst Street, Nieuw Muckleneuk, Brooklyn, Pretoria
Please include your full name, contact details, and a clear description of your request. We will respond within a reasonable time and, where required by law, within the timeframes prescribed by POPIA and PAIA.
We may need to verify your identity before processing your request.
9. Security of your personal information
We take reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, disclosure, interference or destruction. These measures are reviewed and updated on an ongoing basis.
In the event of a security compromise that is likely to affect you adversely, we will notify you and the Information Regulator as required by POPIA.
10. Retention of personal information
We retain personal information only for as long as is necessary for the purpose for which it was collected, or as required by law or our professional obligations. Client matter files are retained for a minimum period consistent with our professional rules and applicable legislation. Once the retention period has lapsed, personal information is securely deleted or destroyed.
11. Third parties and cross-border transfers
We may share your personal information with third parties where necessary, including:
- Service providers who assist us in operating our website or delivering our services (such as cloud hosting, IT support and communication tools);
- Courts, regulatory bodies, counterparties or other legal representatives where required by the nature of a legal matter;
- Professional advisers and auditors.
Where we share personal information with third-party service providers, we require them to process that information only for the specified purpose and in accordance with applicable data protection law.
If personal information is transferred outside South Africa, we will ensure that the recipient country or organisation offers an adequate level of protection consistent with POPIA's requirements.
12. Complaints to the Information Regulator
If you are not satisfied with how we have handled your personal information or responded to your request, you have the right to lodge a complaint with the Information Regulator of South Africa:
Information Regulator (South Africa)
Website: www.inforegulator.org.za
Email: inforeg@justice.gov.za
Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
We encourage you to contact us first so that we have an opportunity to resolve your concern before a formal complaint is lodged.
13. Updates to this notice
We may update this notice from time to time to reflect changes in our practices, legal obligations or regulatory guidance. The updated version will be published on this page with a revised "last updated" date.
