Regulations › Rest of world › South Africa
POPIA
Protection of Personal Information Act (South Africa)
WhenIn effect since 1 July 2021
Who enforces itInformation Regulator
Who it applies toResponsible parties processing personal information in South Africa.
Tell the regulatorNotify the Regulator as soon as reasonably possible after discovering a security compromise
DPO requiredEvery public and private body has an Information Officer (the head by default), who must be re…
RegistrationNo general controller registration
Transfers abroadTransfers abroad allowed only with adequate protection (law, binding corporate rules or agreem…
Request deadline30 days: access requests follow PAIA timelines
Maximum fineAdministrative fine up to R10 million (about USD 550,000)
62%
of South Africa's 21 requirements are already met by European Union (GDPR). Here is what POPIA adds, biggest gaps first.
DPO requiredGovernanceBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
POPIA adds3 Every public and private body has an Information Officer (the head by default), who must be registered with the Regulator before taking up duties.
s.1; s.55(2); s.56 · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
POPIA adds3 Child means under 18. Processing children's information is prohibited unless a s.35 exception applies, such as consent of a competent person.
s.1; ss.34-35 · source ↗
DPO qualificationsGovernanceGap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
POPIA adds2 No legal qualification. Regulator guidance expects executive-level IOs and requires multinationals to authorize an IO and deputies based in South Africa.
Guidance Note on Information Officers (2021) · source ↗
RegistrationGovernanceGap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
POPIA adds1 No general controller registration. Information Officers must be registered; prior authorization needed for listed processing such as credit reporting.
s.55(2); ss.57-58 · source ↗
DPIAGovernanceGap
GDPR2 DPIA required before processing likely to result in high risk; prior consultation if residual high risk remains.
POPIA adds3 The Information Officer must ensure a personal information impact assessment is conducted; not limited to high-risk processing.
Reg. 4(1)(b), POPIA Regulations 2018 (GN R1383) · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
POPIA adds2 Records may not be kept longer than necessary for the purpose and must be destroyed, deleted or de-identified afterward.
s.14(1), (4) · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
POPIA adds3 Notify affected data subjects in every compromise unless their identity cannot be established, as soon as reasonably possible.
s.22(1) · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
POPIA adds2 Listed offenses carry a fine or up to 10 years' imprisonment, others up to 12 months.
s.107 · source ↗
Already covered by GDPR: Reach abroad, Lawful basis, Consent, Sensitive data, Rights, Request deadline, Marketing, Records, Tell the regulator, Transfers abroad, Localization, Maximum fine, Private action.
A gap means POPIA is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws