Barclays Bank plc (South Africa) PAIA Manual
Last updated: May 2021
1. Legal entity details
Entity names and trading names.
Location Legal entity Registered Oce
Address
Company
Registration
Number
Controller or
Processor
Employing
entity
Businesses
included
UK Barclays Bank PLC 1 Churchill Place,
London, E14 5HP
01026167 Controller Yes Corporate Banking
Investment Bank
Private Bank
UK Barclays Services Ltd 1 Churchill Place,
London E14 5HP
01767980 Controller Yes Functional Support
Services
SA Barclays Bank PLC
representative oce
5th Floor, Building
3, 11 Alice
Lane, Sandton,
Johannesburg, 2196
2018/599243/10 Controller Corporate Banking
Investment Bank
Private Bank
Registered oce & trading addresses See table above
Company Numbers See table above
Representation details
Information Ocer / Deputy Information Ocer
InfoOcerSA@barclays.com
Employing entity See table above
Processors
Where a processor within the Barclays Group is acting on behalf of a controller within the Barclays Group, it may process personal data
on behalf of the controller in support of any of the purposes detailed in the Description of Processing below. Processors within the
Barclays Group employ the same technical and organisational security measures as those employed by the controllers, and the same
safeguards for data transfers.
General business description
Barclays Bank PLC South Africa is a representative oce facilitating banking services for Corporate Bank, Private Bank and
Investment Bank clients and processing personal data for the purposes below.
1. Corporate Banking
Corporate Banking supports clients with an annual turnover of over £6.5 million, and large local companies, nancial institutions
and multinationals in non-UK markets. The client base is institutional.
Customer Privacy Notice
https://www.barclayscorporate.com/general-info/customer-privacy-notice/
Regulatory Information Guides
http://home.barclays.intranet/sites/CBProducts/Client-Onboarding/Pages/Global-Documentation-Library.aspx
2. Investment Bank
The Investment Bank provides advice, nancing and risk management solutions to companies, governments and institutions
worldwide. The client base is institutional.
Client Privacy Notice
https://www.investmentbank.barclays.com/disclosures/personal-information-use.html
3. Private Bank
Private Bank (“PB”) oers local, international and private banking and wealth and investment management services to individuals and
institutions. This includes niche investment products, analytics and consulting services; sales and trading; strategic solutions such as
structured/hedging products; wealth advisory; family oce banking. The client base is both personal and institutional.
Client Privacy Notice
https://international.barclays.com/important-information/privacy-policy/full-privacy-notice/
2. General description of technical and security measures
Barclays has introduced and established a range of internal policies, standards, procedures and controls under the functional areas
below in order to ensure that appropriate protection is provided for personal data:
• Privacy
• Information Security & Cyber
• Sourcing & Supplier Management
• Physical Security
• People Screening & Employee Monitoring
• Incident Management
Barclays’ policies, standards and procedures are supported by technological and organisational controls, monitoring and testing,
assurance and audit, and training and awareness.
Personal data is retained and then destroyed in accordance with Barclays’ Records Retention Schedules.
Information on controls Barclays requires third parties to adhere to can be found here:
https://home.barclays/who-we-are/our-suppliers/our-requirements-of-external-suppliers/external-supplier-control-obligations/
3. Description of processing
Reasons/purposes for processing
and our lawful basis for processing
Purpose: HR/Sta administration and management*
*For employing entities only, as per the legal entity list
Categories of Data Subjects
Sta (including applicants, candidates, existing and former sta, contractors and pension
members) and persons nominated by candidates or sta
(including connected and related persons, emergency contacts, references contacts, brokers)
Data processed
Name
Gender and Title
Addresses
Country of Residence
Telephone and Fax Numbers
Email Addresses
Identication Data
Date and Place of Birth
Nationality
Family
Marital Status
Curriculum Vitae Information
(e.g. hobbies/interests, references)
Employment Details
Connected and Related Persons
Pension Details
Financial Data
Insurance Details
Tax Information
Sales Data
Correspondence (e.g. email)
Complaint Information
Transaction Information
Disciplinary, Capability and Grievance
Information
IP address
Location Data
Electronic Trac Data
Images
Voice Recordings
Gifts and Entertainment Details
Background Information/Sanction Data
Dietary/Special Requirements
Medical Data/Sickness/Disability
Race/Ethnicity
Religion/Beliefs
Sexual Orientation
Union Membership
Biometric Data
Categories of Recipients
Categories of recipients described in the Global Fair Processing Notice for Sta Personal
Information.
Employees of the controller
Other Barclays companies
Regulatory and statutory bodies (where local law permits)
Anyone to whom we may transfer our rights and duties (e.g. following the sale or restructuring of a
part of the Barclays business)
Our service providers and agents – details of our key suppliers are available on the Global Managed
Supplier List
Third parties who provide benets or services to sta, such as pension scheme, healthcare and
redundancy support providers
Description of processing & lawful basis
Recruitment and Job Applications
HR Administration and Management
Global Directories Administration and
Management
Planning and Work Organisation
Absence, Sickness and Maternity
Administration
Mobility (e.g. travel, secondments, transfers,
relocation)
Remuneration and Payroll
Benets and Reward Administration and
Management,
(e.g. car scheme administration and share
scheme administration)
Pension Administration and Fund Management
Performance Assessment and Management
Learning, Training and Development
Workplace and Event Management
Company Asset Management and Protection
Expenses Management
Travel Management
HR Dispute Management (including disciplinary,
capability and grievance)
Transaction Management and Monitoring
Monitoring
Marketing
Transfers outside of South Africa
For South African resident clients, their personal data will be hosted in the UK and its Crown
Dependencies.
Global transfers of data are possible where there is a business requirement to do so, and where
globally accessible systems are used, and / or where internal data processors are used.
The key Barclays locations outside of the UK and South Africa for centralised services and internal
data processors are India, Ireland, Singapore and the USA.
Applicable retention period
Personal data retained in accordance with the Barclays Records Retention Schedules.
Reasons/purposes for processing
and our lawful basis for processing
Customer and client administration
Categories of Data Subjects
Prospective, existing and former customers including connected and related persons
Data processed
Name
Gender and Title
Addresses
Country of Residence
Telephone and Fax Numbers
Email Addresses
Identication Data
Date and Place of Birth
Nationality
Family
Connected and Related Persons Customer
Account Information
Customer Business Information
Customer Employment Details
Transaction Information
Financial Data
Insurance Details
Tax Information
Date of Death
Will Information
Fraud Indicator
Correspondence (e.g. email)
Complaint Information
IP address
Location Data
Images
Voice Recordings
Hobbies/Interests
Gifts and Entertainment Details
Background Information
Sanction Data
Marital Status
Race/Ethnicity*
Religion/Beliefs*
Dietary/Special Requirements*
Medical Data/Sickness/Disability*
* By exception and where a condition for
processing the data is satised
Categories of Recipients
Employees of the controller
Other Barclays companies
Our service providers and agents – details of our key suppliers are available on the Global Managed
Supplier List
Our customers’ professional and nancial advisors and agents
Fraud prevention agencies and credit reference agencies
Acquirers or potential acquirers of the business or of customer accounts, in the event of the sale of
any part of the business or account
Other nancial services providers (e.g. pensions or insurance providers), where Barclays is acting
as an introducer on behalf of the client
Regulatory and statutory bodies (where local law permits)
Description of processing & lawful basis
Prospective and New Customer Management
Application Checks (KYC) including Anti Money
Laundering (AML) checks
Customer Administration and Management
(including relationship management)
Account Administration and Management
(including opening and servicing of bank
accounts, credit cards, checks, deposits,
loans, credits, debts, insurance, safe deposits,
mortgages, wealth, investments, hedge funds,
funds and any other products and/or services
provided to customers)
Transaction Processing, Monitoring,
Verication and Analysis
Credit Risk Review and Management
Debt Collection and Recoveries
Marketing and Prospecting
Development/Improvement of Products and
Services and Market Analysis
Legal and Dispute Management
Transfers outside of South Africa
For South African resident clients, their personal data will be hosted in the UK and its Crown
Dependencies.
Global transfers of data are possible where there is a business requirement to do so, and where
globally accessible systems are used, and / or where internal data processors are used.
The key Barclays locations outside of the UK and South Africa for centralised services and internal
data processors are India, Ireland, Singapore and the USA.
Applicable retention period
Personal data is retained in accordance with the Barclays Records Retention Schedules.
Reasons/purposes for processing
and our lawful basis for processing
Purpose: Access control & security management
Categories of Data Subjects
Employees, customers, or members of the public as visitors
Data processed
CCTV images
Sta ID numbers
Electronic Trac Data
Voice Recordings
Categories of Recipients
Not generally disclosed outside Barclays Group except for law enforcement purposes
Description of processing & lawful basis
CCTV & sta monitoring
Identication and Verication Screening
Insider Threat Monitoring
Data Security
Transfers outside of South Africa
For South African resident clients, their personal data will be hosted in the UK and its Crown
Dependencies.
Global transfers of data are possible where there is a business requirement to do so, and where
globally accessible systems are used, and / or where internal data processors are used.
The key Barclays locations outside of the UK and South Africa for centralised services and internal
data processors are India, Ireland, Singapore and the USA.
Applicable retention period
Personal data is retained in accordance with the Barclays Records Retention Schedules & statutory
requirements
Reasons/purposes for processing
and our lawful basis for processing
Purpose: Providing nancial and investments advice*
*(for Private Bank only)
Categories of Data Subjects
Prospective, existing and former customers including connected and related persons
Data processed
Name
Gender and Title
Addresses
Country of Residence
Telephone and Fax Numbers
Email Addresses
Identication Data
Date and Place of Birth
Nationality
Family
Connected and Related Persons Customer
Account Information
Customer Business Information
Customer Employment Details
Transaction Information
Financial Data
Insurance Details
Tax Information
Date of Death
Will Information
Fraud Indicator
Correspondence (e.g. email)
Complaint Information
IP address
Location Data
Images
Voice Recordings
Hobbies/Interests
Gifts and Entertainment Details
Background Information
Sanction Data
Marital Status
Race/Ethnicity*
Religion/Beliefs *
Dietary/Special Requirements*
Medical Data/Sickness/Disability*
*By exception and where a condition for
processing the data is satised
Categories of Recipients
Employees of the controller
Other Barclays companies
Our service providers and agents – details of our key suppliers are available on the Global Managed
Supplier List
Our customers’ professional and nancial advisors and agents
Fraud prevention agencies and credit reference agencies
Acquirers or potential acquirers of the business or of customer accounts, in the event of the sale of
any part of the business or account
Other nancial services providers (e.g. pensions or insurance providers), where Barclays is acting
as an introducer on behalf of the client
Regulatory and statutory bodies (where local law permits)
Description of processing & lawful basis
Wealth and investment management and advice
Transfers outside of South Africa
For South African resident clients, their personal data will be hosted in the UK and its Crown
Dependencies.
Global transfers of data are possible where there is a business requirement to do so, and where
globally accessible systems are used, and / or where internal data processors are used.
The key Barclays locations outside of the UK and South Africa for centralised services and internal
data processors are India, Ireland, Singapore and the USA.
Applicable retention period
Personal data retained in accordance with the Barclays Records Retention Schedules.
Reasons/purposes for processing
and our lawful basis for processing
Purpose: Purchaser and supplier administration
Categories of Data Subjects
Individual customers and clients
Supplier relationship managers and business contacts
Data processed
Job title and business contact details
Financial account information
Categories of Recipients
Other companies in the same group
Services providers and agents processing on our behalf
Description of processing & lawful basis
Supplier Management
Stock Management
Development/Improvement of Products and Services
Market Analysis
Billing, accounts and nancial records
Transfers outside of South Africa
For South African resident clients, their personal data will be hosted in the UK and its Crown
Dependencies.
Global transfers of data are possible where there is a business requirement to do so, and where
globally accessible systems are used, and / or where internal data processors are used.
The key Barclays locations outside of the UK and South Africa for centralised services and internal
data processors are India, Ireland, Singapore and the USA.
Applicable retention period
Generally retained for the life of the customer relationship per product + 6 years.
There will be some exceptions, e.g. transactional data will be held for 6 years after
the completion of the transaction
Reasons/purposes for processing
and our lawful basis for processing
Purpose: Advertising, marketing and public relations
Categories of Data Subjects
Prospective, existing and former customers including connected and related persons
Data processed
Title, gender and name
Home address and contact information
Financial account information
Job title and professional contact information
Dietary and accessibility requirements (if applicable and required for events management)
Categories of Recipients
Employees of the controller
Other Barclays companies
Our service providers and agents – details of our key suppliers are available on the Global Managed
Supplier List
Events management companies (where necessary for an event e.g. attendee/delegate list)
Description of processing & lawful basis
Marketing and Prospecting
Complaint/Query Management
Event and sponsorship management
Data aggregation & customer proling
Transfers outside of South Africa
For South African resident clients, their personal data will be hosted in the UK and its Crown
Dependencies.
Global transfers of data are possible where there is a business requirement to do so, and where
globally accessible systems are used, and / or where internal data processors are used.
The key Barclays locations outside of the UK and South Africa for centralised services and internal
data processors are India, Ireland, Singapore and the USA.
Applicable retention period
Personal data retained in accordance with the Barclays Records Retention Schedules.
Reasons/purposes for processing
and our lawful basis for processing
Purpose: Management information and reporting
Categories of Data Subjects
Management Information and Reporting may be produced about any category of data subject
described in this Record of Processing.
Individual data subjects are unlikely to be identied within nal reports, though it remains possible.
Data processed
Management Information and Reporting may be produced using any categories of data processed
that is described within this Record of Processing.
Categories of Recipients
Employees of the controller
Other Barclays companies
Our service providers and agents – details of our key suppliers are available on the Global Managed
Supplier List
Regulatory and statutory bodies (where local law permits)
Description of processing & lawful basis
Statistical Reports and Analytics
Quality Control and Process Monitoring
Project Management
Facilities Management
Transfers outside of South Africa
For South African resident clients, their personal data will be hosted in the UK and its Crown
Dependencies.
Global transfers of data are possible where there is a business requirement to do so, and where
globally accessible systems are used, and / or where internal data processors are used.
The key Barclays locations outside of the UK and South Africa for centralised services and internal
data processors are India, Ireland, Singapore and the USA.
Applicable retention period
Personal data retained in accordance with the Barclays Records Retention Schedules.
Reasons/purposes for processing
and our lawful basis for processing
Purpose: Legal & regulatory compliance
Categories of Data Subjects
Permanent and temporary employees
Professional advisers and consultants
Individual customers and clients
Data processed
Name and contact information
Employee relatives / friends
Policy breach information
Criminal records
Categories of Recipients
Other companies within the Barclays Group
Not generally disclosed outside Barclays Group
Disclosed to competent authorities to meet regulatory requirements.
Description of processing & lawful basis
Financial Crime
Conict of Interests Monitoring
Whistleblowing
Audit, Monitoring, Assurance Checks and Testing
Employment details
Licencing/registration details
Complaint information
Gifts and Entertainment Details
Transfers outside of South Africa
For South African resident clients, their personal data will be hosted in the UK and its Crown
Dependencies.
Global transfers of data are possible where there is a business requirement to do so, and where
globally accessible systems are used, and / or where internal data processors are used.
The key Barclays locations outside of the UK and South Africa for centralised services and internal
data processors are India, Ireland, Singapore and the USA.
Applicable retention period
Personal data is retained in accordance with the Barclays Records Retention Schedules
& statutory requirements
Reasons/purposes for processing
and our lawful basis for processing
Purpose: Directories administration & management
Categories of Data Subjects
Barclays employees (permanent, temporary and contract sta)
Data processed
Name and internal contact information
(oce/desk location, telephone numbers and Barclays email address
Job title and reporting line
Photograph
Personal email address and telephone numbers
(for Business Continuity Management/ Disaster Recovery purposes)
Categories of Recipients
All Barclays’ employees globally that have access to the intranet (the personal/out of hours contact
information is not published, and is only available to Business Continuity Management team)
Our service providers and agents – details of our key suppliers are available on the Global Managed
Supplier List
Description of processing & lawful basis Phone book
Transfers outside of South Africa
For South African resident clients, their personal data will be hosted in the UK and its Crown
Dependencies.
Global transfers of data are possible where there is a business requirement to do so, and where
globally accessible systems are used, and / or where internal data processors are used.
The key Barclays locations outside of the UK and South Africa for centralised services and internal
data processors are India, Ireland, Singapore and the USA.
Applicable retention period
For the life of the employee relationship – when an employee leaves Barclays his or her data
is removed from the Phone Book.
IBIM10729 September 2021