POPIA

South Africa Privacy

Status

In force (fully effective 1 July 2021); amended POPIA Regulations effective 17 April 2025.

Who it applies to

Personal information of living individuals AND existing companies/juristic persons. Covers parties domiciled in South Africa, or not domiciled there but using processing means in South Africa (other than mere transit).✓Sources: gov.za, dlapiperdataprotection.com

Size thresholds

No size threshold. Prior authorisation from the Regulator is needed for certain processing (e.g., credit reporting, some unique identifiers, special/children's data sent to non-adequate countries).✓Sources: gov.za, inforegulator.org.za, dlapiperdataprotection.com

Regulator

Information Regulator (South Africa)✓Sources: inforegulator.org.za, dlapiperdataprotection.com

Breach or incident reporting

Notify the Information Regulator and affected people as soon as reasonably possible after discovering a security compromise (s22). Since 1 April 2025, reports must go through the Regulator's e-Portal.✓Sources: gov.za, inforegulator.org.za, inforegulator.org.za, dlapiperdataprotection.com

Deadline to answer personal data requests

Access requests are handled under PAIA: private bodies must decide within 30 days of receipt (s56), extendable once by up to 30 days (s57).✓Sources: acts.co.za, inforegulator.org.za

Data protection officer

Every organisation has an Information Officer (by default the head) who must be registered with the Regulator before taking up duties; deputies may be designated.✓Sources: gov.za, inforegulator.org.za, dlapiperdataprotection.com

Local representative

No separate local representative requirement found.✓Sources: gov.za, dlapiperdataprotection.com

Sending data abroad

Allowed if the recipient is bound by substantially similar protection (law, BCRs or agreement), the person consents, the transfer is needed for a contract, or it benefits the person.✓Sources: lawlibrary.org.za, dlapiperdataprotection.com

Cookies and consent

Unsolicited electronic direct marketing needs opt-in consent, except to existing customers for similar products with an opt-out. Ask for consent only once. Opt-out is not valid consent (2025 regs). Calls count as electronic.✓Sources: gov.za, inforegulator.org.za, dlapiperdataprotection.com, cliffedekkerhofmeyr.com

Maximum penalty

Administrative fine up to ZAR 10 million; up to 10 years' imprisonment for certain offences; civil damages claims also possible.✓Sources: inforegulator.org.za, dlapiperdataprotection.com, michalsons.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Register your Information Officer (and any deputies) on the Regulator's portal.
• Report security compromises via the Information Regulator e-Portal as soon as reasonably possible.
• Get opt-in consent before electronic direct marketing to non-customers; remember opt-out is not consent.
• Record or log telephone requests for deletion or objection so they can be retrieved.
• Get prior Regulator authorisation before high-risk processing such as credit reporting.
• Decide access requests within 30 days.

Recent changes

E-Portal breach reporting mandatory from 1 April 2025; amended POPIA Regulations effective 17 April 2025 (new forms, opt-out not valid consent, telephone requests must be recorded). Health information regulations for insurers, medical schemes, pension funds and employers gazetted and in force 6 March 2026 (GG 54268).✓

Sources

• Primary source: https://inforegulator.org.za/
• Second source: https://www.cliffedekkerhofmeyr.com/news/publications/2025/Sectors/Technology-Communications/Technology-and-Communications-Alert-21-May-Important-POPIA-amendments-to-note
• Regulator: Information Regulator (South Africa)

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.