POPIA

Who it applies to

Responsible parties and operators processing personal information in South Africa, including information about juristic persons such as companies.

Key requirements

• Eight conditions: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.
• Register an Information Officer with the Information Regulator.
• Prior authorisation for certain high-risk processing.
• Restrictions on processing special personal information and children's information.
• Restrictions on cross-border transfers and direct marketing by electronic communication.

Breach and incident notification

Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, notify the Information Regulator and the data subject as soon as reasonably possible after discovery (section 22).

Penalties

Administrative fines of up to ZAR 10 million, and imprisonment for certain offences.

Go deeper