Regulations › Rest of world › South Africa
POPIA
Protection of Personal Information Act (South Africa)
WhenIn effect since 1 July 2021
Who enforces itInformation Regulator
Who it applies toResponsible parties processing personal information in South Africa.
Tell the regulatorNotify the Regulator as soon as reasonably possible after discovering a security compromise
DPO requiredEvery public and private body has an Information Officer (the head by default), who must be re…
RegistrationNo general controller registration
Transfers abroadTransfers abroad allowed only with adequate protection (law, binding corporate rules or agreem…
Request deadline30 days: access requests follow PAIA timelines
Maximum fineAdministrative fine up to R10 million (about USD 550,000)
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
1
Applies to responsible parties domiciled in South Africa, or not domiciled but using automated or non-automated means in the Republic.s.3(1)(b) · source ↗
Lawful basis
1
Six lawful grounds including consent, contract, legal obligation, and legitimate interests of the responsible party or a third party.s.11(1) · source ↗
Consent
2
Consent must be a voluntary, specific and informed expression of will; electronic direct marketing consent follows a prescribed form.s.1 (definition); s.69(2); Reg. 6 and Form 4 · source ↗
Form 4 requirement from the 2018 Regulations as amended by GN 6126 (2025), seen only in secondary summaries.
Sensitive data
2
Special personal information is prohibited unless consent or a listed exception applies; the Regulator may authorize processing in the public interest.ss.26-27 · source ↗
Consolidated statute text on acts.co.za. Prior authorization also applies under s.57 for some uses.
Children
3
Child means under 18. Processing children's information is prohibited unless a s.35 exception applies, such as consent of a competent person.s.1; ss.34-35 · source ↗
s.34-35 text not read in full; prohibition confirmed through s.4(4).
People's rights
Rights
3
Access, correction, deletion, objection (including direct marketing), protection from solely automated decisions, and restriction in limited cases.ss.5, 11(3), 14(6), 23, 24, 71 · source ↗
No portability right. Restriction under s.14(6) is a controller duty in listed cases; counted as a right.
Request deadline
2
30 days: access requests follow PAIA timelines; amended regulations give 30 days to give feedback on correction or deletion requests.s.23(3) (PAIA procedure); Reg. 3 as amended by GN 6126 (2025) · secondary source · source ↗
PAIA s.56(1) text not fetched (blocked); 30 days is the standard PAIA period.
Marketing
2
Electronic direct marketing requires prior opt-in consent, which may be requested only once; existing customers may receive similar offers with an opt-out.s.69(1)-(3) · source ↗
Governance
DPO required
3
Every public and private body has an Information Officer (the head by default), who must be registered with the Regulator before taking up duties.s.1; s.55(2); s.56 · source ↗
DPO qualifications
2
No legal qualification. Regulator guidance expects executive-level IOs and requires multinationals to authorize an IO and deputies based in South Africa.Guidance Note on Information Officers (2021) · source ↗
Guidance, not binding law. Training recommended, not mandatory.
Registration
1
No general controller registration. Information Officers must be registered; prior authorization needed for listed processing such as credit reporting.s.55(2); ss.57-58 · source ↗
DPIA
3
The Information Officer must ensure a personal information impact assessment is conducted; not limited to high-risk processing.Reg. 4(1)(b), POPIA Regulations 2018 (GN R1383) · secondary source · source ↗
Regulation text not read directly; requirement is broad but its scope and content are not prescribed.
Records
2
Responsible parties must maintain documentation of all processing operations, as required by PAIA manuals.s.17 · source ↗
Retention
2
Records may not be kept longer than necessary for the purpose and must be destroyed, deleted or de-identified afterward.s.14(1), (4) · source ↗
s.14(4) destruction duty not quoted in the text read; s.14(1) confirmed.
Breaches
Tell the regulator
1
Notify the Regulator as soon as reasonably possible after discovering a security compromise; no fixed hour limit. Filed through the eServices portal since April 2025.s.22(1)-(2) · source ↗
Tell people
3
Notify affected data subjects in every compromise unless their identity cannot be established, as soon as reasonably possible.s.22(1) · source ↗
Transfers
Transfers abroad
2
Transfers abroad allowed only with adequate protection (law, binding corporate rules or agreement), consent, contract necessity, or data subject benefit.s.72(1) · source ↗
Prior Regulator authorization is required for special or children's data sent to countries without adequate protection (s.57(1)(d)).
Enforcement
Criminal liability
2
Listed offenses carry a fine or up to 10 years' imprisonment, others up to 12 months.s.107 · source ↗
Private action
2
Data subjects, or the Regulator on their behalf, may sue for patrimonial, non-patrimonial and aggravated damages, regardless of intent or negligence.s.99(1), (3) · source ↗
POPIA does not address class actions; they may be possible under general South African law.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws