Protection of Personal Information Act - Section 13
"Personal information must be collected a specific, explicitly defined, lawful purpose related to a function of the responsible party. "
"Steps must be taken in accordance with section 18(1) to ensure that the data subject is aware of the purpose of the collection of the information unless this provision is not applicable."
Have you explicitly defined the purpose for processing personal information?
Is your attempt to make data subjects aware of your processing of their personal information genuinely transparent?
Have you made use of all the available options to be transparent?