South Africa POPIA — Protection of Personal Information Act
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeFrameworkLegal InstrumentActSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionAfricaRegion DetailSouth AfricaPublisherParliament of the Republic of South Africa (Act 4 of 2013); enforced by the Information Regulator (South Africa)
- VersioningVersionProtection of Personal Information Act 4 of 2013 (Government Gazette 37067); Regulations of December 14, 2018 as amended April 17, 2025 (Government Notice 6126)Effective DateJuly 1, 2020 (sections 2 to 38, 55 to 109, 111, 114(1) to (3)), with a transition to June 30, 2021; Information Regulator provisions April 11, 2014; sections 110 and 114(4) June 30, 2021; section 58(2) July 1, 2021Issue DateAssented to November 19, 2013; published November 26, 2013 (Government Gazette 37067)
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Act is South African legislation published free by the South African Government (gov.za, Government Gazette 37067) and by the Information Regulator, which also publishes the Regulations, guidance notes and forms free of charge.
Framework text is licensed by its publisher and is included only where stated above.
- South Africa's Protection of Personal Information Act 4 of 2013 binds every public and private body that processes personal information in South Africa.
- Its substantive provisions commenced July 1, 2020, with a one-year transition that ended June 30, 2021.
- Chapter 3 sets eight conditions for lawful processing, from accountability to data subject participation.
- The Information Regulator enforces it and issued its first R5 million fine to the Department of Justice on July 4, 2023.
- Responsible parties register an Information Officer, keep records of processing, and report security compromises.
Overview
The Protection of Personal Information Act 4 of 2013 (POPIA) is South Africa's data protection law: it binds every public and private body, called a responsible party, that processes personal information in South Africa, sets eight conditions for lawful processing in Chapter 3, and is enforced by the Information Regulator, an independent body established by section 39. Parliament passed the Act and the President assented to it on November 19, 2013 (Government Gazette 37067 of November 26, 2013); its substantive provisions commenced on July 1, 2020, with a one-year transition under section 114(1) that ended on June 30, 2021.
Commencement came in stages by proclamation. Section 1, Part A of Chapter 5 (sections 39 to 54, the Information Regulator) and sections 112 and 113 took effect on April 11, 2014; sections 2 to 38, 55 to 109, 111 and 114(1) to (3) on July 1, 2020; sections 110 and 114(4) on June 30, 2021; and section 58(2), on prior authorization, on July 1, 2021. The Regulations Relating to the Protection of Personal Information were published on December 14, 2018 (Government Gazette 42110) and amended with immediate effect on April 17, 2025 (Government Gazette 52523, Government Notice 6126).
A responsible party complies by meeting the eight conditions (accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation, section 4), by registering an Information Officer with the Regulator before that officer takes up duties (section 55), by notifying the Regulator and data subjects of a security compromise as soon as reasonably possible (section 22), by seeking prior authorization for the processing listed in section 57, and by meeting the direct marketing, automated decision-making and transborder flow rules in sections 69, 71 and 72. Administrative fines of up to R10 million (section 109) and criminal penalties of up to ten years' imprisonment (section 107) apply.
Why does it matter?
POPIA gives effect to the right to privacy in section 14 of the Constitution and it is enforced. The Information Regulator issued its first infringement notice with a R5 million administrative fine to the Department of Justice and Constitutional Development on July 4, 2023, after an enforcement notice of May 10, 2023 over a security compromise, and a second R5 million fine to the Department of Basic Education on December 23, 2024. Section 109 allows administrative fines of up to R10 million per infringement notice; section 107 provides for fines or imprisonment of up to ten years for the serious offenses and up to twelve months for the others. Every responsible party must also have registered its Information Officer with the Regulator before that officer takes up duties (section 55(2)).
Key benefits include:
- Eight named conditions
Section 4 lists the conditions and the sections that carry them (8; 9 to 12; 13 and 14; 15; 16; 17 and 18; 19 to 22; 23 to 25), so a compliance program has a fixed map.
- A registered accountable officer
Section 55 makes the Information Officer responsible for encouraging compliance, handling requests and working with the Regulator, and requires registration with the Regulator before the officer acts.
- Security duties written into the Act
Section 19 requires appropriate, reasonable technical and organizational measures and a cycle of identifying risks, maintaining safeguards, verifying them and updating them; section 22 requires notification of security compromises.
- Direct marketing by consent
Section 69 prohibits electronic direct marketing unless the data subject has consented or is an existing customer, with one approach permitted to seek consent; the 2025 Regulations state that opt-out is not consent.
- Transfers and automated decisions regulated
Section 72 allows a transfer outside South Africa only on adequacy by law, binding corporate rules or agreement, consent, contract necessity or the data subject's benefit, and section 71 restricts decisions based solely on automated processing.
How does it work?
Chapter 3 holds the eight conditions. Accountability (section 8) makes the responsible party answerable for all of them. Processing limitation (sections 9 to 12) requires lawful, minimal processing on one of the section 11 grounds: consent, contract, legal obligation, the data subject's legitimate interest, a public law duty or the legitimate interests of the responsible party or a third party, with the burden of proving consent on the responsible party and a right to object. Purpose specification (sections 13 and 14) requires a specific, explicitly defined and lawful purpose and no retention longer than necessary. Further processing limitation (section 15) ties later use to the original purpose. Information quality (section 16) requires complete, accurate, not misleading and updated information.
Openness (sections 17 and 18) requires documentation of processing and notification to the data subject of what is collected, the source, the responsible party's name and address, the purpose, whether supply is voluntary or mandatory and the consequences of not supplying it. Security safeguards (sections 19 to 22) require measures against loss, damage, unauthorized destruction, unlawful access and processing, written contracts with operators (section 21) and notification of security compromises to the Regulator and to data subjects as soon as reasonably possible after discovery, in writing by one of the channels section 22(4) lists. Data subject participation (sections 23 to 25) gives the right to confirm free of charge whether information is held, to obtain the record and to request correction or deletion.
Part B of Chapter 3 restricts special personal information (religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information and criminal behavior, section 26) and the personal information of children (section 34), subject to the authorizations in sections 27 to 33 and 35. Chapter 6 requires prior authorization from the Regulator before processing unique identifiers for linking, criminal or objectionable-conduct information for third parties, credit reporting, or transfers of special or children's information to a country without adequate protection (section 57). Chapter 7 lets the Regulator issue codes of conduct that carry the full conditions (section 60); approved codes exist for the banking industry and for credit bureaus. Chapter 10 provides complaints, assessments, enforcement notices (section 95) and the penalties in sections 100 to 109.
Key Elements
- Conditions for lawful processing (sections 8 to 25)
Accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.
- Information Officer (sections 55 and 56)
Encourages compliance, deals with requests, works with the Regulator on investigations and ensures compliance; registered with the Regulator before taking up duties; deputies designated under section 56.
- Security compromise notification (section 22)
Notice to the Regulator and to data subjects as soon as reasonably possible after discovering unauthorized access or acquisition, delayed only where a public body or the Regulator determines it would impede a criminal investigation.
- Special and children's information (sections 26 to 35)
General prohibitions on processing special personal information and children's information, lifted only by the specific authorizations or the Regulator's authorization.
- Direct marketing, directories and automated decisions (sections 69 to 71)
Consent or existing-customer basis for electronic direct marketing, a single request for consent on the prescribed form, and limits on decisions based solely on automated processing.
- Transborder flows and prior authorization (sections 72 and 57)
Transfer grounds for personal information leaving South Africa and the processing that requires the Regulator's prior authorization.
What does it cover?
Section 3 applies the Act to the processing of personal information entered in a record by or for a responsible party domiciled in South Africa, or not domiciled there but using automated or non-automated means in South Africa other than for forwarding. Personal information covers identifiable, living natural persons and, where applicable, existing juristic persons, so company information is in scope. Section 6 excludes purely personal or household activity, de-identified information, certain state security and law-enforcement functions, Cabinet and judicial functions, and section 7 provides for journalistic, literary and artistic purposes. Both public and private bodies are responsible parties, and operators processing on their behalf act under a written contract and the security duties in sections 20 and 21.
What are its objectives?
Section 2 states the purpose of the Act. It aims to:
Give effect to the constitutional right to privacy by safeguarding personal information processed by a responsible party, balanced against the right of access to information and the free flow of information within the Republic and across borders.
Regulate the manner in which personal information may be processed by establishing conditions, in harmony with international standards, that prescribe the minimum threshold requirements for lawful processing.
Provide persons with rights and remedies to protect their personal information from processing that is not in accordance with the Act.
Establish an Information Regulator to exercise the powers and perform the duties and functions under the Act and the Promotion of Access to Information Act.
Provide for codes of conduct, rights regarding unsolicited electronic communications and automated decision making, and the regulation of transborder information flows.
Framework in Context
POPIA follows the condition-based structure of earlier European data protection law and shares concepts with the GDPR, including a lawful-basis list, special categories, breach notification, data protection impact assessments through the Regulations, and transfer restrictions, but it differs in detail: the responsible party and operator take the place of controller and processor, juristic persons are protected, notification of a security compromise is required as soon as reasonably possible rather than within a fixed number of hours, administrative fines are capped at R10 million, and the Information Officer is a statutory role that must be registered. The Act is administered alongside the Promotion of Access to Information Act 2 of 2000, for which the same Information Officer and Regulator are responsible, and industry codes of conduct approved under Chapter 7 translate the conditions for banking and credit bureaus.
Common Framework Mappings
Organizations map POPIA's conditions to the frameworks below so that one privacy control set and evidence library serves the Information Regulator, overseas regulators and customer assessments.
Mapped frameworks include:
APEC PF
LGPD
CCPA/CPRA
GDPR
ISO 27701
NIST Privacy Framework v1.0
UK GDPR
UK DPA 2018
How SmartSuite Supports POPIA
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management to hold the eight conditions and the sections beneath them as requirements, with the Information Officer and deputies as owners, the records of processing that openness requires, the operator contracts, the section 57 prior authorizations and the section 22 security compromise workflow with its notifications to the Regulator and data subjects.
Eight Conditions Requirement Library
Load sections 8 to 25 as requirements grouped by condition, each with owner, status, linked policy and the evidence that shows compliance.
Information Officer Register
Record the Information Officer and deputy information officers, their registration with the Regulator, the PAIA manual and the compliance framework the Regulations require of them.
Processing Records and Notices
Document each processing activity, its section 11 ground, purpose, retention rule, operator and the section 18 notice given to data subjects.
Data Subject Requests and Objections
Track section 23 to 25 access, correction and deletion requests and section 11 objections on the Regulations' forms, with deadlines, responses and complaints to the Regulator.
Security Compromise Workflow
Run the section 19 risk cycle and the section 22 workflow: discovery, notice to the Regulator, notices to data subjects by the prescribed channels and any investigation-related delay.
Transfers, Prior Authorization and Marketing
Log section 72 transfer grounds, section 57 prior authorization applications and section 69 direct marketing consents in Third Party Risk Management and Privacy Management.
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out, and is enforced by the California Privacy Protection Agency.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
Frequently Asked Questions For South Africa POPIA (Protection of Personal Information Act)
Every responsible party, public or private, that processes personal information entered in a record in South Africa, and a responsible party outside South Africa that uses means in the country other than for forwarding (section 3). Personal information covers living natural persons and, where applicable, existing juristic persons. Section 6 excludes purely personal or household activity, de-identified information and certain state and judicial functions.
Section 4 lists them with their sections: accountability (8), processing limitation (9 to 12), purpose specification (13 and 14), further processing limitation (15), information quality (16), openness (17 and 18), security safeguards (19 to 22) and data subject participation (23 to 25). Special personal information and children's information carry additional prohibitions in sections 26 to 35.
Section 22 requires the responsible party to notify the Regulator and, unless their identity cannot be established, the affected data subjects as soon as reasonably possible after discovering that personal information has been accessed or acquired by an unauthorized person. Notification to data subjects may be delayed only where a public body responsible for investigating offenses or the Regulator determines that it would impede a criminal investigation, and it must be in writing by one of the channels in section 22(4).
Under section 55 the Information Officer encourages compliance with the conditions, deals with requests made under the Act, works with the Regulator on investigations and otherwise ensures compliance, and may take up those duties only after the responsible party has registered the officer with the Regulator. Regulation 4 adds duties including a compliance framework, personal information impact assessments, a PAIA manual and internal awareness sessions; deputies are designated under section 56.
Section 109 lets the Regulator issue an infringement notice with an administrative fine of up to R10 million, payable within 30 days, in installments by arrangement, or contested in court. Section 107 provides, on conviction, for a fine or imprisonment of up to ten years for the serious offenses (including obstruction of the Regulator and offenses involving account numbers) and up to twelve months for the others. The Regulator imposed its first R5 million fine on July 4, 2023.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.