Data protection in South Africa.

The Protection of Personal Information Act (POPIA), Act 4 of 2013, sets out how personal information may be processed in South Africa. Most of it commenced on 1 July 2020, and compliance became fully enforceable on 1 July 2021. The Information Regulator oversees it.

Get started Check your readiness

In force: July 2021
Regulator: Information Regulator
Maximum fine: ZAR 10 million

Supported via Kenya Hub

Pretoria

At a glance

South Africa, in seven lines.

Law: Protection of Personal Information Act (POPIA), Act 4 of 2013
In force: Most provisions 1 July 2020; fully enforceable July 2021
Regulator: Information Regulator
Registration: Register your Information Officer with the Regulator
Information officer: Required for every organisation
Breach notification: As soon as reasonably possible, to the Regulator and data subjects (section 22)
Maximum penalties: Administrative fines up to ZAR 10 million (section 109); up to 10 years' imprisonment for listed offences (section 107)

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Key obligations

What the law asks of you.

Four obligations organisations in South Africa meet first, and where we help with each.

Register your Information Officer

Every organisation needs an Information Officer, registered with the Regulator.

DPO360 helps with

Formal DPO appointment and mandate definition, where permitted by law

Breach notification

Notify the Regulator and affected data subjects as soon as reasonably possible. There is no fixed hour limit, and since 1 April 2025 breach reports go through the Regulator's eServices portal.

DPO360 helps with

Incident and breach logging, escalation and regulator notification

Lawful processing

POPIA sets conditions for processing personal information lawfully, from purpose and consent to security safeguards.

DPO360 helps with

Full policy architecture and records of processing

Transfers abroad

Transfers of personal information outside South Africa are restricted and need a lawful basis.

DPO360 helps with

Cross-border data transfer governance: legal basis, safeguards and approvals

How the framework came together

From the law to the regulator.

2013
POPIA is signed into law
The Protection of Personal Information Act, Act 4 of 2013, is signed into law.
1 July 2020
Most provisions commence
Most of the Act commences, with a one-year period for organisations to adjust.
1 July 2021
Fully enforceable
Compliance becomes enforceable, with the Information Regulator overseeing it.

South Africa

Regulatory authority

Information Regulator

The Information Regulator oversees POPIA, receives registrations of Information Officers and enforces compliance.

Adv. Pansy Tlakula, Chairperson

Visit the website

What the regulator does

Registers Information Officers
Every organisation registers its Information Officer with the Regulator.
Handles complaints
Investigates complaints about how personal information is handled.
Enforces POPIA
Enforces the Act with administrative and criminal penalties.

Penalties

What non-compliance can cost.

Administrative fines

ZAR 10M

up to, administrative fine (section 109)

The Information Regulator can impose an administrative fine of up to ZAR 10 million, set by weighing factors such as the number of data subjects affected.

Imprisonment

10 yrs

up to, for listed offences (section 107)

Imprisonment applies to listed offences, such as obstructing the Regulator or ignoring an enforcement notice. Lesser offences carry up to 12 months.

Readiness check

Where do you stand?

Tick what is already in place. A quick read on where you stand in South Africa, for orientation only.

0/6

Plenty to tighten.

A short scoping call will map the gaps and the order to close them.

Close the gaps with us

Our Information Officer is registered with the Regulator.Every organisation needs an Information Officer.
We process personal information on a lawful basis and for a stated purpose.POPIA sets conditions for lawful processing.
We can notify the Regulator and data subjects as soon as reasonably possible after a breach.A tested incident plan makes this achievable.
Transfers of personal information abroad have a lawful basis.Transfers outside South Africa are restricted.
Our policies and privacy notices are documented.Documentation makes every other item easier to evidence.
We keep records of what we process, where and why.Records and data maps support every obligation.

Compare

Eight countries at a glance.

Tap a country to highlight its column. Scroll sideways for the rest.


Law	Protection of Personal Information Act (POPIA)	Data Protection Act, 2019	Nigeria Data Protection Act (NDPA), 2023	Data Protection and Privacy Act, 2019	Personal Data Protection Act, 2022	Law No. 058/2021	Data Protection Act, 2021	Data Protection Act, 2024
In force	July 2021 (most provisions from July 2020)	November 2019	June 2023	May 2019 (regulations March 2021)	May 2023	October 2021 (full compliance October 2023)	April 2021	June 2024
Regulator	Information Regulator	Office of the Data Protection Commissioner (ODPC)	Nigeria Data Protection Commission (NDPC)	Personal Data Protection Office (PDPO)	Personal Data Protection Commission (PDPC)	National Cyber Security Authority (NCSA)	Office of the Data Protection Commissioner	Malawi Communications Regulatory Authority (MACRA)
Registration	Register your Information Officer with the Regulator	Mandatory above thresholds, and in certain sectors, with the ODPC	Controllers and processors of major importance register with the NDPC	Every data collector, processor and controller registers with the PDPO	Collectors and processors register with the PDPC	Controllers and processors register with the NCSA	No one may act as a controller or processor without registering	Controllers and processors of significant importance register with MACRA
Data protection officer	Information Officer required for every organisation	May be designated; relevant for public bodies, large-scale monitoring and sensitive data	Mandatory for controllers of major importance	A DPO must be designated by the head of the institution	A DPO must be appointed	Required in certain cases (large-scale monitoring or sensitive data)	A DPO must be appointed, under the Commissioner's guidelines	Required for public authorities, and for large-scale monitoring or sensitive data
Breach notification	As soon as reasonably possible, to the Regulator and data subjects	Within 72 hours to the ODPC; data subjects within a reasonably practical period	Within 72 hours to the NDPC; data subjects immediately where high risk	Immediately, to the PDPO	Promptly, to the PDPC	Within 48 hours to the NCSA	Within 24 hours to the Commissioner; data subjects as soon as practicable	Within 72 hours to MACRA
Penalties	Administrative fines up to ZAR 10 million; up to 10 years' imprisonment for listed offences	Up to KES 5 million or 1% of annual turnover, whichever is lower; offences: up to KES 3 million and/or 10 years	Major importance: greater of NGN 10 million or 2% of annual gross revenue; others: greater of NGN 2 million or 2%	Up to about UGX 4.8 million and/or 10 years for listed offences	Penalty notices up to TZS 100 million; companies up to TZS 5 billion; individuals up to TZS 20 million and/or 10 years	Administrative fines of RWF 2 to 5 million or 1% of global turnover; corporate criminal fines of 5% of annual turnover	Corporate bodies: greater of 100 million penalty units or 2% of annual turnover; individuals up to 1 million penalty units and/or 5 years	Administrative penalties up to MWK 20 million; ignoring a compliance order: MWK 20 million and up to 5 years
		Open briefing →	Open briefing →	Open briefing →	Open briefing →	Open briefing →	Open briefing →	Open briefing →

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Reviewed October 2026 against: Protection of Personal Information Act 4 of 2013 (sections 22, 107 and 109) and Information Regulator guidance.

Additional resources

Read the source documents.

Information RegulatorRegulator website POPIALegislation (PDF)

Supported through

Kenya Hub

East, Central & Southern Africa

DPO360 in South Africa

How we support organisations in South Africa.

South Africa is supported through our Kenya hub, which covers East, Central & Southern Africa, with delivery coordinated from our Nairobi headquarters.

Registration and licensing filings with the national authority
Breach logging, escalation and regulator notification
Consent, policy and records-of-processing frameworks
Data mapping, including where data is processed
Data subject access request management
A standing DPO appointment, with DPO-as-a-Service

2nd Floor 90 JGO, James Gichuru Road, Lavington

P.O Box 40583-00100 Nairobi, Kenya

+254735360360 | +447394407463

Ready to Make Privacy Your Advantage?

Speak to our team about compliance in South Africa and beyond.

Book a consultation DPO-as-a-Service

Data protection in South Africa.

South Africa, in seven lines.

What the law asks of you.

Register your Information Officer

Breach notification

Lawful processing

Transfers abroad

From the law to the regulator.

POPIA is signed into law

Most provisions commence

Fully enforceable

Information Regulator

Registers Information Officers

Handles complaints

Enforces POPIA

What non-compliance can cost.

Where do you stand?

Eight countries at a glance.

Read the source documents.

How we support organisations in South Africa.

Ready to Make Privacy Your Advantage?