Privacy Map

South Africa. Comprehensive data protection. Act

POPIAProtection of Personal Information Act 4 of 2013 (POPIA)

In force

§1Summary

Synopsis

South Africa's comprehensive privacy statute, built around eight conditions for lawful processing by 'responsible parties' and 'operators'. It protects natural and (unusually) juristic persons, regulates direct marketing and cross-border transfers, and is enforced by the Information Regulator, which also administers PAIA.

Key themes
  • eight processing conditions
  • juristic persons protected
  • information officers
  • prior authorisation
  • direct marketing opt-in
  • security compromise notification
  • cross-border transfers
Unique features

Protects juristic persons (companies) as well as individuals. Information Officers must be registered with the Regulator, and prior authorisation is needed for certain processing (profiling/unique identifiers, credit reporting, third-party criminal data, and transfers of special or children's data to non-adequate countries). All security compromises must be reported via the eServices Portal regardless of risk level.

SaaS relevance

Applies to processing by responsible parties domiciled in SA or using automated means in SA, so a SaaS vendor serving SA customers is typically an 'operator' bound by contract and must report security compromises to its customer immediately.

§2Obligations

Extraterritorial
Limited
Breach notification
Regulator and data subjects as soon as reasonably possible (eServices Portal; no risk threshold)
DPO
Yes
Cross-border transfers
Substantially similar law/BCRs/binding agreement, consent, contract necessity
Maximum penalty
ZAR 10m administrative fine and/or up to 10 years' imprisonment

§3Dates

Key dates
  • Adopted
  • In force
  • Partial commencement 2014-04-11 (definitions, Regulator); main provisions 2020-07-01 with 12-month grace to 2021-07-01; amended Regulations 2025; security-compromise reporting via eServices Portal mandatory from 2025-04-01

§4Text and authority

Text
Authority
Information Regulator (South Africa)

§5Where it applies

Domestic law of
South Africa

§6Sources and verification

Sources consulted
Verification

High confidence.

Information Officer = mandatory head of body (deputy officers optional); treated as DPO equivalent.