POPIA and GDPR Compliance Handbook for QR Campaigns

What This Handbook Covers

This handbook explains shared compliance responsibility when running QR campaigns that involve analytics or personal data collection.

POPIA and GDPR in Practical Terms

1. POPIA: Governs lawful processing of personal information in South Africa.
2. GDPR: Governs personal data processing for EU data subjects.

Many teams must align to both, especially with cross-border traffic.

Platform Responsibilities

Platform-level protections include secure transport and controlled processing for scan analytics workflows.

Your Responsibilities (Controller Side)

If destination pages collect personal data, you must:

1. Display a clear privacy notice.
2. Provide lawful basis/consent where required.
3. Minimize data collection to what is necessary.
4. Retain data only as long as needed.
5. Support user rights requests under applicable law.

Campaign Compliance Checklist

Before launch:

1. Confirm destination privacy policy is live.
2. Confirm cookie/consent handling is configured.
3. Confirm form fields collect only necessary information.
4. Confirm retention and deletion process exists.
5. Confirm internal owner for privacy requests.

After launch:

1. Audit analytics and form flows quarterly.
2. Review third-party processors and integrations.
3. Update notices if processing purpose changes.

High-Risk Mistakes to Avoid

1. Collecting PII without clear disclosure.
2. Using broad "just in case" form fields.
3. No process for deletion/access requests.
4. Routing sensitive campaigns without legal review.

Regional GEO Note (South Africa)

For South African commercial campaigns, POPIA transparency and consent clarity are not optional. They directly affect trust, complaint risk, and enterprise procurement readiness.

Related Guides

• API key governance: enterprise-authentication.
• Analytics interpretation: tracking-your-scans.
• Terms and policy references: /terms and /privacy.