POPIA – Protection of Personal Information Act (South Africa)

The Protection of Personal Information Act (POPIA) is South Africa's comprehensive data protection law. Enacted in 2013, it came into full effect on July 1, 2021. POPIA enshrines the right to privacy as a fundamental right and establishes eight conditions for lawful processing of personal information.

• Supervisory authority: Information Regulator of South Africa.
• Scope: Public and private responsible parties domiciled in South Africa.
• Data subject rights: Access, correction, deletion, objection, notification of data breaches.
• Sanctions: Fines up to ZAR 10 million and imprisonment up to 10 years.

POPIA's development is closely linked to the enshrinement of the right to privacy in the South African Constitution of 1996 (Section 14). The South African Law Reform Commission (SALRC) began drafting data protection legislation in the early 2000s, which ultimately resulted in POPIA being enacted in 2013.

The law came into force incrementally: the Information Regulator was established in 2016, but most operational provisions took effect on July 1, 2020, with a one-year grace period until July 1, 2021, from which compliance became mandatory. The COVID-19 pandemic influenced implementation through specific regulations on health data processing. The Information Regulator has since become increasingly active in investigations and enforcement.

POPIA applies to public and private responsible parties domiciled in South Africa or using automated or non-automated means in South Africa. Exempt from POPIA include:

• Purely personal or household data processing
• Anonymized or de-identified data
• Data processed solely for publication (journalism)
• Processing for national security, public interest, or law enforcement (with limitations)

The Act distinguishes between personal information (all information about an identifiable natural or juristic person) and special categories (racial/ethnic origin, political persuasion, religious/philosophical belief, trade union membership, health, sexual life, biometric data, criminal behavior, children's data).

• Eight conditions for lawful processing: Accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, data subject participation.
• Notification duty: Data subjects must be informed at the time their data is collected.
• Consent: Voluntary, specific, and informed consent as primary legal basis.
• Data subject rights: Access to held data, correction, deletion, objection to direct marketing.
• Processing limitation: Data may only be used for the purpose for which it was collected.
• Security: Appropriate technical and organizational security safeguards.
• Data breach notification: Prompt notification to the Information Regulator and affected data subjects.
• International transfers: Only to countries with adequate protection levels or under guarantees.
• Direct marketing: Opt-out right; stricter opt-in requirements for electronic communications.

POPIA (South Africa) is equivalent to GDPR — baseline cross-reference was missing.

1 correction:
- Constitution date wrong: 1996 instead of 1997
2 clarifications.
1 note.