Right to be informed

Experian is a registered credit bureau with the National Credit Regulator (NCRCB16) and a member of the Credit Bureau Association (“CBA”). As a credit bureau, we play a key role in South Africa’s financial ecosystem. 

We may process your personal information as part of regulatory obligations under the National Credit Act or to assist you in obtaining credit responsibly, protect you against reckless lending or as consented by you.

Your personal information belongs to you. If your personal information is used unlawfully or in a manner that infringes your privacy you may object to its processing. 

For you to know who and how your personal information is being used, organisations who have your personal information must notify you that they have your information and how they are using it. We process large volumes of personal information and it is likely that we have your information. This document gives notice about how we obtain, process and share personal information about consumers (individual data subjects) and businesses (juristic data subjects) as data subjects when conducting our business as a credit bureau. For more detailed information, please visit our Trust Centre.

If you think we have your personal information or wish to check if we do, you can find helpful material and the relevant form to confirm this with us by visiting our Right of Access page.

A description of your right to access your information and to request that we correct or destroy the information is provided here.

We have published a lot of information and content across this Trust Centre to ensure you are informed of what data we collect and how we use it and as well as the basis for us using your data and what your rights are in terms of POPIA. You can also view our "frequently asked questions" (FAQ) page which is updated regularly.

Our function as a credit bureau and in processing your information for credit reporting purposes is governed by the National Credit Act and its Regulations (NCA). The NCA promotes transparency and fairness in the access to credit. It also promotes responsible borrowing by consumers and the protection of consumers against reckless credit granting.

We obtain personal information from a number of sources:

• SACRRA members: The South African Credit and Risk Reporting Association, which is a non-profit, voluntary industry association of qualifying companies who share credit and risk payment performance data about their customers with their registered credit bureau members. Qualifying companies include credit providers who are registered with the National Credit Regulator such as banks, micro-financing institutions, retail companies who make goods available to you on credit terms and then also telecommunications service providers, insurance companies and other providers of goods and services on monthly contractual repayment terms.
• Clients: Companies who pay Experian for services that have a legitimate reason to submit data to Experian. Our clients may ask us to undertake work on their own customer data, such as cleaning the data or appending our models and segments so that they can better understand their own customers. Here we act as a data processor on their behalf and do not use any of this information in our own products and services.
• Public information sources. We also obtain personal information from publicly available sources. This data might come from the courts, Government / Local Municipal data such as Deeds Office, Courts, Home Affairs and CIPC.
• Other data providers allowed for in the NCA including debt counsellors (debt counselling status); debt collectors; educational institutions; entities involved in fraud investigations; South African Fraud Prevention Services; other registered credit bureaus; and yourself. 

To process your personal information to meet our regulatory obligations and/or provide information lawfully to credit providers in compliance with the NCA, we process various information elements. This includes consumer credit information as described in Section 70 of the NCA, and specifically includes your name, surname, contact details, addresses, account history information, employment information and educational information.

Without this information the processing of information required to grant you credit lawfully and fairly, cannot be processed. You may also then not be able to apply for services.

If you require access to your personal information, for your protection we must authenticate the identity of the requestor and we will need additional information from you to do so. The procedures for requesting access to your information are available on our Right of Access page

The full details of the information that we process is available in a manual that we publish as required by the Promotion of Access to Information Act 2 of 2000 (PAIA) available here.

We do not retain your information for any longer than necessary to achieve the purpose for which it was collected. The Regulations to the NCA require that we that we display and use various categories of your information only for the maximum periods prescribed for the purpose of credit scoring or credit assessment. We ensure that this information is not displayed for these purposes beyond the maximum periods prescribed.

We retain certain elements of your information as long as is necessary, for the purpose of verifying the integrity of information that we may be required to process in the future or for data quality purposes (i.e. to prevent the re-loading of incorrect information). This information is securely stored and not used for any other purpose than data quality in support of our regulatory obligation to ensure the data we have is relevant and accurate and not duplicated. 

Our main databases are hosted in Stellenbosch and Johannesburg, South Africa and, as such, your personal information will, on the whole, remain within South Africa.

However, we also operate elsewhere in the world and may access your personal information from these locations as well. We will also sometimes engage service providers to support our business and they may be based, or use data centres, overseas. Where we or our service providers do so, then we will ensure your personal information is adequately protected. There are different ways that this can be achieved, for example, where it is transferred to a country which has adequate protection in place, subject to a corporate bindings rule programme or by putting contracts in place to ensure it is protected.