When an interpreter joins a conversation between your organisation and a customer, personal information flows through a third party. Under the Protection of Personal Information Act (POPIA), that is a processing activity you are responsible for – so it pays to get it right.
How POPIA applies
Your organisation is usually the responsible party: you decide why and how the personal information in the conversation is processed. An interpreting provider that processes that information on your behalf acts as an operator. POPIA expects you to have a written agreement with operators and to make sure they apply appropriate security safeguards.
Many interpreted conversations also involve special personal information – for example health information in a clinic, or information about a person’s disability. This attracts stricter conditions, so data minimisation and confidentiality matter even more.
Key principles in an interpreting context
- Minimality: collect and keep only what is needed – typically session time, duration, language and role, not the content of the conversation.
- Security safeguards: encryption in transit, strong access control, audit logs and regular testing.
- Confidentiality: interpreters should be contractually bound to keep everything they hear and see confidential.
- Transparency: tell customers that an interpreter will join and how session data is handled.
- Cross-border transfers: if data leaves South Africa, POPIA’s transfer conditions apply. Local hosting simplifies compliance.
Seven questions to ask your interpreting provider
- Are sessions encrypted end to end, and is anything recorded by default?
- Where is session data hosted, and for how long is it retained?
- Will you sign an operator agreement that reflects POPIA?
- How are interpreters vetted, and do they sign confidentiality undertakings?
- Can we control who in our organisation can start sessions and see reports?
- What audit information is available if a customer disputes what was said?
- How do you handle a security incident, and how quickly will you notify us?
How SignBridge SA approaches it
SignBridge SA was designed for regulated environments such as banking, healthcare and government. Sessions are encrypted, interpreters are vetted and bound by confidentiality, data is hosted in South Africa and only essential session data is processed. Read more on our security page or ask us for our privacy documentation.
This article is general information, not legal advice. Speak to your Information Officer or legal adviser about your specific obligations.
