What is POPIA?
POPIA gives effect to the constitutional right to privacy in South Africa. It regulates how “responsible parties” (controllers) and “operators” (processors) handle personal information. Unusually, it protects juristic persons (companies) as well as individuals.
Who does it apply to?
Processing of personal information entered in a record by a responsible party domiciled in South Africa, or using means in South Africa, with some exclusions, such as purely household activity and certain journalistic and state security purposes.
The eight conditions for lawful processing
- Accountability
- Processing limitation (lawfulness, minimality, consent or justification, collection directly from the subject)
- Purpose specification
- Further processing limitation
- Information quality
- Openness, including notification to the data subject
- Security safeguards
- Data subject participation (access and correction)
Key duties
- Information officer: by default the head of the organisation, registered with the Information Regulator, with deputies as needed. They are responsible for compliance, including a PAIA (access to information) manual.
- Special personal information, such as religious or philosophical beliefs, race, health, biometrics and criminal behaviour, and children’s information may be processed only under specific authorisations.
- Security compromises: notify the Information Regulator and affected data subjects as soon as reasonably possible after discovering a compromise. Notification to the Regulator is made through its e-portal.
- Direct marketing by electronic communication needs opt-in consent from non-customers.
- Cross-border transfers are allowed only to recipients bound by adequate protections, or with consent or another listed condition.
Enforcement
The Information Regulator can issue enforcement notices and administrative fines of up to R10 million. Some offences carry imprisonment.
How does it relate to other frameworks?
POPIA’s conditions map well to GDPR principles. The roles of information officer and PAIA manual are South Africa-specific.
Sources and official references
- Information Regulator (South Africa) — Information Regulator (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with Republic of South Africa; enforced by the Information Regulator.
