What is the scope of privacy and confidentiality obligations under FAIS and POPIA?

• A. They apply only to written records.
• B. They require disclosure of client data to all parties upon request.
• C. They protect client data from unauthorized access, limit disclosures, and ensure secure data handling and retention.
• D. They allow unlimited retention of data.

Answer: (C)

The main idea is that privacy and confidentiality obligations apply broadly to how client information is handled in financial services. Under FAIS, licensees and advisers must keep client information confidential and may only disclose it when there is a lawful basis (such as consent, contractual necessity, a legal obligation, or to protect legitimate interests) and only to those who need it for the service. POPIA reinforces this with principles like purpose limitation, data minimization, accountability, security safeguards, and retention limits. Taken together, they cover all forms of data—written records, electronic data, emails, and information held by third-party service providers—and require appropriate technical and organizational measures to prevent unauthorized access, limit disclosures, and retain data only as long as needed or legally required. So, the scope is about protecting client data from unauthorized access, controlling who may receive it, and ensuring secure handling and retention. Disclosing to everyone or allowing unlimited retention would not align with these requirements.