Policies

Privacy notice

Draft · Last updated 12 October 2026

This notice explains what personal information the Digital Compliance Hub processes, why, who it is shared with and the rights you have under the Protection of Personal Information Act, 2013 (POPIA).

Draft for legal review.This text has not been approved. Remove this notice and the review notes once CSIR Legal has signed it off.

Who we are

The Digital Compliance Hub (the Hub) is a facility established and governed by the Council for Scientific and Industrial Research (CSIR). For the purposes of POPIA, the CSIR is the responsible party for personal information processed by the Hub.

In this notice, "we", "us" and "our" refer to the CSIR acting through the Hub.

What this notice covers

  • This website.
  • The Hub verification service, which you reach from the "Verify a device entering SA" button.
  • The processing the Hub carries out to verify information about devices entering South Africa.

Information we process

When you visit this website

  • This website does not use cookies, analytics or advertising trackers. See our cookie notice.
  • Our hosting provider records standard technical logs, such as your IP address, browser type, the pages requested and the time of the request, to keep the website secure and running.
  • If you enter an IMEI number in the verification panel, it is checked on your own device. It is only sent to the Hub verification service if you choose to continue.
For legal and technical reviewConfirm the hosting provider, what its logs contain and how long they are kept.

When the Hub verifies a device

  • Device identifiers, such as the IMEI number, make and model.
  • Information from import declarations and supporting documents.
  • Details of the person or organisation making the request, such as name, organisation, contact details and customs reference numbers.
  • The outcome of the verification.

Why we process it

  • To verify information about devices entering South Africa.
  • To provide verification outcomes to public institutions with a legal mandate to act on them, starting with SARS Customs.
  • To help prevent the trade in counterfeit, stolen and misdeclared devices.
  • To keep our systems and services secure.
  • To meet our legal obligations.
  • To improve our methods, using de-identified information wherever possible.

Our lawful basis

We process personal information only where POPIA allows it. Depending on the activity, this includes processing that is necessary to comply with an obligation imposed by law, for the proper performance of a public law duty by a public body, or to pursue a legitimate interest.

For legal reviewConfirm the specific grounds under section 11(1) of POPIA for each processing activity, and whether any further authorisation is required for the processing of unique identifiers across responsible parties.

Who we share it with

  • Public institutions with a legal mandate to act on verification outcomes, such as SARS Customs.
  • Service providers who process information on our behalf as operators. They may only do so under a written agreement, on our instructions and with appropriate security safeguards, as POPIA requires.
  • Anyone else only where the law requires or permits it.

We do not sell personal information.

Where it is stored

Information processed by the Hub is hosted and held by the CSIR in South Africa. If information ever needs to be transferred outside South Africa, we will only do so in line with section 72 of POPIA.

How long we keep it

We keep personal information only for as long as we need it for the purposes in this notice, or for as long as the law requires. After that, it is securely deleted or de-identified.

For legal reviewInsert or reference the Hub's records retention schedule.

How we protect it

We use appropriate technical and organisational measures to protect personal information against loss, damage and unauthorised access, including access controls, encryption and monitoring. Operators who work with us are bound by the same obligations.

Your rights

  • Ask whether we hold personal information about you and request a copy. Requests for records are handled under the CSIR's PAIA manual.
  • Ask us to correct or delete personal information that is inaccurate, out of date or unlawfully obtained.
  • Object to processing in the circumstances POPIA allows.
  • Lodge a complaint with the Information Regulator. Details are on the Information Regulator's website.

Contact our Information Officer

Name
[Information Officer name]
Email
[Information Officer email]
Phone
[Information Officer phone]
Address
[Postal address]

Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last updated.