PART B – POPIA MANUAL

11. Purpose and Scope

11.1 This Part describes how FFSA processes personal information in accordance with the Protection of Personal Information Act, 2013.

11.2 It applies to all personal information processed by FFSA in the course of its governance, safety, and regulatory functions.

12. Responsible Party

12.1 FFSA is the responsible party for all personal information processed in its systems and records.

12.2 FFSA determines the purpose and means of processing and retains exclusive control over such records.

13. Categories of Data Subjects

13.1 FFSA processes personal information relating to:

• Members and pilots
• Instructors, examiners, and assessors
• Club officials and volunteers
• School operators and staff
• Event organisers
• Incident witnesses and reporters
• Contractors and service providers

14. Categories of Personal Information

14.1 Personal information processed may include:

• identity and contact details;
• licensing, ratings, and experience records;
• medical or fitness declarations where required;
• incident, accident, and safety-related information;
• complaints, disciplinary, and compliance records;
• insurance and claims-related information.

1. 2 Information relating to incidents or discipline may include opinions, assessments, and third-party statements and is subject to heightened confidentiality controls.

15. Purpose and Lawful Basis for Processing

15.1 Personal information is processed for purposes including:

• membership administration;
• licensing and safety oversight;
• compliance with aviation regulations;
• incident and accident investigation;
• insurance administration;
• governance, disciplinary, and corrective processes.

15.2 Processing occurs on the basis of:

• legal and regulatory obligations;
• contractual necessity;
• legitimate interests relating to aviation safety and governance.

15.3 Where permitted by law, such processing may occur without consent.

16. Data Submissions by Third Parties

16.1 FFSA may permit limited, controlled submission of data via application programming interfaces (APIs), including by FFSA-recognised schools, solely for the purpose of recording required activity.

16.2 Such interfaces:

• are unidirectional;
• do not permit access to other records;
• do not constitute delegation of authority;
• do not transfer ownership or control of records.

16.3 All records remain under the exclusive control of FFSA.

17. Information Security Safeguards

17.1 FFSA implements appropriate technical and organisational measures to protect personal information, including:

• role-based access controls;
• audit logging;
• system and process controls;
• contractual safeguards with service providers.

18. Retention of Personal Information

18.1 Personal information is retained only for as long as necessary to fulfil its purpose or as required by law, regulation, or oversight obligations.

19. Data Subject Rights and Limitations

19.1 Data subjects may request access to, correction of, or deletion of personal information in accordance with POPIA and PAIA.

19.2 Such rights may be limited where their exercise would:

• compromise safety reporting or investigation processes;
• prejudice disciplinary or corrective action;
• infringe the rights of other individuals;
• undermine lawful governance or regulatory functions.

19.3 Requests relating to incidents or disciplinary matters will be assessed contextually and may be refused or limited where justified by law.

20. Complaints

20.1 Complaints relating to the processing of personal information may be lodged with the Information Regulator (South Africa).

21. Interpretation and Non-Circumvention

21.1 Nothing in this Manual shall be interpreted as:

• creating rights of access beyond those provided for in PAIA;
• limiting FFSA’s authority to manage safety, discipline, or governance matters;
• requiring disclosure where such disclosure would be unlawful, unsafe, or unfair.

21.2 This Manual may not be used to circumvent FFSA’s internal rules, processes, or corrective mechanisms.