If you are an entity processing any personal information for any purposes in South Africa, then you must comply with the country’s Protection of Personal Information Act 4 of 2013 (POPIA). Its ultimate goal is to protect personal information, and non-compliance can lead to severe penalties. In this article, we talk about POPIA compliance in South Africa, its scope, and whom it applies to. Let’s dive in.

Introduction: What is POPIA?

The Protection of Personal Information Act 4 of 2013, commonly known as the POPI Act or POPIA (Act), is the personal information act in South Africa. It governs how personal information is collected, used, stored, and shared within a lawful framework.

POPIA defines ‘personal information’ as any piece of information that can be used to identify a natural person. It can be information related to race, gender, location, social origin, biometric data, and more.

After a year-long grace period of compliance for businesses and other entities processing data in South Africa, the Act came into full effect from June 30, 2021.

The primary objective of the Act is to protect individual privacy rights. The Act outlines the safeguards against data misuse, theft, and discrimination. It applies to any person or company that processes personal data within South Africa, even if they are not physically present in the country.

For example, if a company is based overseas but uses automated or non-automated means to process data within South Africa, then the company must comply with POPIA.

One may consider POPIA to be South Africa’s version of the EU's General Data Protection Regulation (GDPR), but there are a few key differences. In this article, we will focus solely on POPIA Compliance in South Africa.

POPIA Compliance in South Africa: What is the Scope?

POPIA Compliance refers to processing personal information in accordance with the requirements of the Act. It applies to businesses of all sizes. If you are processing personal information in South Africa, POPIA is and will always be your concern.

Below is the list of some of the entities the Act applies to:

  1. Sole proprietors
  2. Existing close corporations
  3. Companies
  4. Non-profit organisations
  5. Relevant public sector parties

The Act distinguishes between a ‘responsible party’, which determines the purpose and means of processing personal information, and an ‘operator’, which processes information on behalf of a responsible party under a contract or mandate.

This distinction matters because organisations often use external service providers (operators) to handle personal information. Examples may include cloud providers, payroll companies, marketing platforms, and other outsourced services.

Furthermore, you should also understand the term ‘data subject’. POPIA defines ‘data subject’ as the person to whom personal information relates. For example, customers would be the primary data subjects for local businesses.

POPIA compliance is more than just having a privacy policy on the website. It requires all the responsible parties to understand what personal information they handle, why they process that information, and what safeguards they have in place.

Foreign Organisations Processing Information in South Africa

POPIA does not apply only to South African entities. It can also apply to foreign entities that process personal information about people in South Africa or target people in South Africa.

A foreign company that uses South African resources such as infrastructure or manpower, or conducts any business that involves local customer data, may be regarded as a responsible party under POPIA.

The Act regulates cross-border data transfers under Section 72, which allows transfer of personal information under certain conditions.

The foreign recipient provides adequate protection

The recipient must be subject to a law, binding corporate rules, or an agreement that provides substantial protection similar to POPIA. The rules must also deal with further transfers of the information to other foreign parties.

The person has consented

When the data subject itself consents to their personal information being transferred internationally, it is allowed.

The transfer is necessary for a contract

The transfer can be allowed when it is necessary to perform a contract between the person and the organisation. It can also apply when the transfer is needed to take steps before entering into a contract at the person’s request.

The transfer benefits the person

A transfer can also be allowed when it is necessary to conclude or perform a contract between the organisation and another party for the benefit of the data subject.

The transfer is necessary for the person's benefit

There is another exception where the transfer benefits the data subject, obtaining their consent is not reasonably practical, and it is likely that they would have consented if it had been practical to ask them.

Note that simply the South African infrastructure handling data transits through the country does not trigger POPIA. Think of it like a transit flight. If you are only passing through a country on your way to another destination, you generally do not need a visa to enter that country.

It is the active processing of personal information within the Republic that triggers POPIA. So, even if your company operates overseas, POPIA obligations apply. In such cases, the regulations must be observed by the responsible party, generally through an operator.

How Does Information Processing Happen Under POPIA?

POPIA outlines conditions for general processing of personal information in South Africa—given that these do not override the conditions mentioned in the sections of processing of special personal information, as well as processing of personal information of children, unless exceptions are met.

The Eight Conditions for Lawful Processing of General Information

Accountability

Responsible parties—a business or a public body—must own up to how they handle personal data. This must be done in conjunction with POPIA guidelines about compliance.

Processing Limitations

Collect the data you actually need. All collections must be appropriately justified. There must always be a clear, lawful purpose for why you are collecting certain data.

Purpose Specifications

Businesses must clarify the purpose for which personal data is collected. They must only be kept for as long as they serve an actual, lawful purpose. In other words, if you don’t need it, you must discard the data. No backups, no hidden copies.

Further Processing Limitations

Data is for its intended purpose only. Any further processing of the data must be compatible with the purpose for which it was originally collected.

Information Quality

Quality here refers to accuracy and relevance of the data. Perform regular checks and update wherever necessary to ensure the information remains relevant and correct.

Openness

Transparency is in the details. Make sure your privacy policy is always detailed about data subjects. It must always inform individuals about what data you collect, why, and how it will be processed.

Security Safeguards

Security measures are important as you are required to protect the data you store. Hence, use the right measures to prevent data breaches. This includes technical measures and organisational measures.

Data Subject Participation

Under POPIA, South African individuals have the right to know what information is held about them. They can request corrections or deletions, as they see fit. As the responsible party, you must respect data subject rights such as access, correction, or deletion.

Lawful Processing of Special Personal Information

Processing of special personal information is generally prohibited, unless one of the following conditions is fulfilled:

  • The said processing is carried out with the data subject’s consent.
  • Processing is necessary in a legal context such as establishment, exercise, or defence of a person’s right or legal obligation.
  • To comply with an obligation of international public law.
  • Processing in the special contexts of historical, statistical, or research purposes.
  • The data subject itself deliberately makes the information public.
  • As long as the provisions in Sections 28 to 33 are complied with.

The sections mentioned above outline the nature of special personal information that responsible parties cannot generally process.

This includes a data subject’s:

  • Religious or philosophical beliefs
  • Race or ethnic origin
  • Trade union membership
  • Political persuasion
  • Health or sex life
  • Criminal behaviour or biometric information

Processing of Personal Information of Children

No responsible party is allowed to process data concerning children, unless certain conditions are met. They are more or less similar to the aforementioned conditions in Special Personal Information, but with an added layer of consent.

When a minor’s data is involved, a competent person must be present to give consent.

POPIA defines a ‘competent person’ as someone who is legally competent to consent to any action or decision being taken in respect of any matter concerning a child.

In certain situations, the Information Regulator has to be involved in order to process personal information related to children. For example, a child protection NGO tracking vulnerable or runaway children needs the involvement of the Regulator to access their data as there is no ‘competent person’ to provide consent.

For more information, we invite you to read these guidance notes on processing of personal information of children.

Building a POPIA Compliance Programme

Effective compliance starts with understanding the personal information flowing through the organisation.

Businesses should identify:

  • The information they collect
  • The purposes for processing it
  • Where it is stored
  • Who can access it
  • Which third parties receive it

The organisation should then review its privacy notices, internal policies, contracts, access controls, retention practices, and information-security measures.

Employee awareness also matters because staff can create privacy risks through everyday activities such as sharing information, using email, or accessing customer records.

Additionally, companies must register their respective Information Officers with the Information Regulator of South Africa as part of their compliance programme. Consider this as the responsible party’s representative who upholds the POPIA compliance policies.

The Information Officer is generally the head of the business who is registered with the Information Regulator. They are responsible for developing compliance frameworks, conducting audits, training staff, and handling data subject requests.

In large organisations, an Information Officer or Officers must be appointed and registered with the Regulator before performing POPIA duties.

Conclusion: Staying Compliant

POPIA compliance in South Africa should not be treated as a once-off exercise. Organisations should regularly review their processing activities, update security safeguards, train employees, and reassess relationships with operators and other third parties.

Failing to do so may have severe consequences. From a fine of up to R10 million to 10 years of imprisonment or both, the penalties vary. Not to mention the reputational damage and a substantial amount of damage to the trust factor—which does not sit well for a business.

Ultimately, POPIA compliance requires an organisation to build privacy and information security into its everyday operations. A clear understanding of personal information, lawful processing, responsible data management, and appropriate security safeguards can help businesses meet their obligations while protecting the people whose information they handle.

For starters, we highly recommend getting yourself familiar with the Act.