POPIA: South Africa's Protection of Personal Information Act

What Is POPIA? South Africa's POPI Act Explained

POPIA, also called the POPI Act, is the Protection of Personal Information Act 4 of 2013, South Africa's main data protection law. Its key sections commenced on 1 July 2020, and after a one-year grace period it has been fully enforced since 1 July 2021 by the Information Regulator. POPIA sets the rules for how any organisation collects, uses, stores, shares and deletes personal information in South Africa, including data collected through websites, cookies and marketing emails.

This guide covers who POPIA applies to, the eight conditions for lawful processing, consent and direct marketing, cookies, data subject rights, Information Officers, cross-border transfers, breach notification, penalties, how POPIA compares with the GDPR, and a practical website compliance checklist.

POPIA at a glance

Full name	Protection of Personal Information Act 4 of 2013
Short names	POPIA, POPI Act
Commenced	1 July 2020 (most sections)
Enforced from	1 July 2021, after a 12-month grace period
Regulator	Information Regulator (South Africa)
Protects	Natural persons and juristic persons (companies)
Maximum penalty	Fine of up to R10 million and/or up to 10 years' imprisonment
Breach reporting	Mandatory, via the Regulator's eServices portal since April 2025

Who does POPIA apply to?

POPIA applies to any responsible party that processes personal information and is domiciled in South Africa, or that is not domiciled in South Africa but uses automated or non-automated means in South Africa to process personal information (unless those means are only used to forward information through the country).

POPIA uses its own terms:

• Data subject: the person the personal information relates to.
• Responsible party: the public or private body or person that decides the purpose and means of processing (the GDPR "controller").
• Operator: a person who processes personal information for a responsible party under a contract or mandate (the GDPR "processor").
• Information Officer: the person responsible for POPIA compliance inside the organisation.

Juristic persons are protected too

Unlike the GDPR, POPIA protects juristic persons, such as companies and close corporations, as well as individuals. In POPIA a "person" means a natural person or a juristic person, so information about client companies, suppliers and business contacts can also fall within the Act.

The 8 conditions for lawful processing

POPIA is built on eight conditions. A responsible party must meet all of them whenever it processes personal information.

#	Condition	What it means in practice
1	Accountability	The responsible party must ensure, and be able to show, that all conditions are met
2	Processing limitation	Process lawfully, minimally and on a valid ground such as consent
3	Purpose specification	Collect data for a specific, explicitly defined and lawful purpose, and keep it only as long as needed
4	Further processing limitation	Any further processing must be compatible with the original purpose
5	Information quality	Keep personal information complete, accurate and up to date
6	Openness	Keep documentation and tell data subjects what is collected and why
7	Security safeguards	Protect personal information with appropriate technical and organisational measures
8	Data subject participation	Let people access and correct their personal information

Lawful grounds and consent under POPIA

Section 11 of POPIA allows personal information to be processed only if one of these grounds applies:

• The data subject (or a competent person, for a child) consents.
• Processing is necessary to conclude or perform a contract with the data subject.
• Processing complies with an obligation imposed by law.
• Processing protects a legitimate interest of the data subject.
• Processing is necessary for a public body to perform a public law duty.
• Processing is necessary for the legitimate interests of the responsible party or a third party.

POPIA defines consent as "any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information". The responsible party bears the burden of proving consent, and a data subject can withdraw consent at any time. This makes reliable consent records essential.

Direct marketing: section 69 requires opt-in

Section 69 prohibits direct marketing by electronic communication (email, SMS, fax or automatic calling machines) unless the person has given consent or is an existing customer.

• Existing customers: you may market your own similar products or services if you obtained the contact details in the context of a sale, and you offered a free, easy way to opt out when you collected the details and in every message.
• Everyone else: you may ask for consent only once, and only if the person has not refused before.
• Every message must identify the sender and include contact details where the recipient can ask you to stop.

The amended POPIA Regulations, effective from 17 April 2025, confirm that an opt-out does not count as consent for direct marketing by unsolicited electronic communication. Consent may now be requested in a form substantially similar to the prescribed Form 4, and through other channels such as email, SMS or telephone, and requests made by telephone must be recorded.

Does POPIA require cookie consent?

POPIA does not contain a cookie-specific rule like the EU ePrivacy Directive. However, POPIA's definition of personal information includes online identifiers, location information and other identifying assignments. Cookies, device IDs, IP addresses and tracking pixels that can identify a visitor are therefore personal information, and setting them is processing that needs a lawful ground and must meet the eight conditions.

In practice, this means:

• Strictly necessary cookies (security, load balancing, shopping carts) can usually rely on contract or legitimate interest.
• Analytics, advertising and social media cookies are hard to justify without consent, especially when they build profiles or share data with third parties outside South Africa.
• Openness requires a clear cookie notice explaining what is collected, by whom and why.
• Consent must be provable, so you need records of who agreed to what and when.

A cookie banner that blocks non-essential tags until the visitor agrees, and stores a log of each choice, is the most practical way to meet POPIA for website tracking.

Data subject rights under POPIA

Data subjects have the right to:

• Be notified that their personal information is being collected, and be notified of a security compromise.
• Request access to their personal information.
• Request correction, destruction or deletion of their personal information.
• Object to processing on reasonable grounds, and object to processing for direct marketing.
• Not receive unsolicited electronic direct marketing without consent.
• Not be subject to decisions based solely on automated processing that have legal or substantial effects.
• Submit a complaint to the Information Regulator.
• Institute civil proceedings for damages.

A self-service privacy portal and a clear DSAR process make these requests easier to receive, verify and answer on time.

Information Officer registration

Every organisation has an Information Officer. For a private company this is, by default, the head of the organisation, such as the CEO, who may delegate duties to one or more Deputy Information Officers. Section 55(2) requires Information Officers to be registered with the Information Regulator before taking up their duties. Registration is done through the Regulator's eServices portal.

The Information Officer is responsible for encouraging compliance, handling data subject requests, working with the Regulator during investigations, and developing a compliance framework and PAIA manual. The role is similar in function to a Data Protection Officer (DPO) under the GDPR.

Cross-border transfers (section 72)

A responsible party may transfer personal information to a third party in a foreign country only if:

• The recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, substantially similar to POPIA's conditions;
• The data subject consents to the transfer;
• The transfer is necessary to perform a contract with the data subject, or to take pre-contractual steps at their request;
• The transfer is necessary for a contract concluded in the data subject's interest with a third party; or
• The transfer is for the data subject's benefit, consent is not reasonably practicable, and the data subject would likely consent.

Websites that load analytics, advertising or chat tools hosted abroad are transferring personal information out of South Africa, so these rules matter for every third-party script on your site.

Security compromise notification (section 22)

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and the affected data subjects as soon as reasonably possible. Operators must tell the responsible party immediately.

Since April 2025, the Information Regulator requires security compromises to be reported through its eServices portal, and email submissions are no longer accepted. Unlike the GDPR, POPIA has no fixed 72-hour deadline and no risk threshold: every compromise must be reported.

The 2025 amended POPIA Regulations

The Information Regulator published amendments to the POPIA Regulations, effective from 17 April 2025. Key changes include:

• Opt-out does not constitute consent for electronic direct marketing.
• Consent to direct marketing can be requested in a form substantially similar to Form 4, and through more channels.
• More ways for data subjects to object, request corrections and lodge complaints, and wider eligibility to complain.
• A more streamlined complaints process.

POPIA penalties

POPIA is enforced through criminal penalties, administrative fines and civil claims:

Enforcement tool	Maximum
Serious offences, such as obstructing the Regulator or failing to comply with an enforcement notice	A fine and/or imprisonment of up to 10 years
Less serious offences	A fine and/or imprisonment of up to 12 months
Administrative fine issued by the Information Regulator	Up to R10 million
Civil action by data subjects	Damages, including for non-patrimonial loss

The Regulator can also issue enforcement notices requiring an organisation to stop or change its processing. Reputational damage from a public enforcement notice can cost more than the fine itself.

POPIA vs GDPR

POPIA was strongly influenced by EU data protection law, so organisations already working towards GDPR compliance have a head start. The main differences:

Topic	POPIA	GDPR
Who is protected	Natural and juristic persons	Natural persons only
Roles	Responsible party, operator	Controller, processor
Compliance lead	Information Officer, registered with the Regulator	DPO, required only in certain cases
Breach notification	As soon as reasonably possible, every compromise	Within 72 hours, unless unlikely to result in risk
Electronic direct marketing	Opt-in consent or existing customer (s69)	Mainly governed by the ePrivacy rules
Cookies	No cookie-specific rule; cookies are personal information	Cookie consent under the ePrivacy Directive
Maximum fine	R10 million administrative fine	EUR 20 million or 4% of global annual turnover
Imprisonment	Up to 10 years for serious offences	Not in the GDPR itself

See how other countries compare in our global privacy laws overview.

POPIA website compliance checklist

1. Register your Information Officer and any Deputy Information Officers on the Regulator's eServices portal.
2. Map your data: list every form, cookie, tag and third-party tool that collects personal information.
3. Scan your website for cookies and trackers, and categorise them.
4. Deploy a cookie banner that explains each purpose and blocks non-essential cookies until consent.
5. Keep consent logs to prove who consented, to what, and when.
6. Publish a clear privacy notice covering the information listed in section 18, plus a cookie policy.
7. Use opt-in consent for email and SMS marketing, and include an unsubscribe link in every message.
8. Review cross-border transfers to analytics, ad tech and cloud providers under section 72.
9. Sign agreements with operators that require them to keep information secure and report compromises.
10. Set up a process for data subject requests, including access, correction and deletion.
11. Prepare a breach response plan that includes reporting through the eServices portal.
12. Review regularly, especially when you add new tags or marketing tools.

How UniConsent helps with POPIA compliance

UniConsent is a consent management platform that turns the website part of POPIA into a few simple settings:

• Cookie banner: a customisable banner and notice that explains each purpose in clear language, in multiple languages.
• Cookie scanning: automatic discovery and categorisation of the cookies and trackers on your site.
• Prior blocking: analytics, advertising and social media tags stay blocked until the visitor consents.
• Consent logs: every choice is recorded with a timestamp, giving you proof of consent if the Regulator asks.
• Preference centre: visitors can change or withdraw consent at any time, as easily as they gave it.
• Privacy portal: one place for visitors to submit access, correction and deletion requests.
• Google Consent Mode v2 and IAB TCF: consent signals flow to your analytics and advertising tools automatically.
• Global coverage: one setup covers POPIA, the GDPR and many other privacy laws, with rules by visitor location.

Start free with UniConsent and make your website POPIA ready in minutes.

This guide is for general information only and is not legal advice.