South Africa
POPIA compliance, made simple
POPIA is South Africa's data protection law. It sets rules for how any organisation collects, uses, stores, shares and deletes personal information about people, and it gives those people rights over their data. If you hold information about customers, staff, suppliers or website visitors, POPIA almost certainly applies to you.
ComplianceDesk gives you 22 pre-built POPIA controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving POPIA compliance stops being a spreadsheet exercise.
Take the free self-assessment: a score for each area and a list of gaps to close.
What is POPIA?
POPIA is South Africa's data protection law. It sets rules for how any organisation collects, uses, stores, shares and deletes personal information about people, and it gives those people rights over their data. If you hold information about customers, staff, suppliers or website visitors, POPIA almost certainly applies to you.
- Official name
- Protection of Personal Information Act 4 of 2013 (POPIA)
- Status
- In force. The Act's main provisions are in force and the transitional grace period has ended. Always check the Information Regulator's notices for new guidance and forms.
- Regulator
- Information Regulator (South Africa)
Who it applies to
- Any business, NGO, public body or individual that processes personal information in South Africa
- Organisations outside South Africa that process personal information using means in South Africa
- Both the 'responsible party' that decides why data is processed and the 'operator' that processes it on their behalf (for example a payroll or cloud provider)
Who it does not apply to
- Purely personal or household activity
- Fully de-identified information that cannot be re-identified
- Certain exclusions for national security, journalism and similar activities set out in the Act
What you have to do
Follow the eight conditions for lawful processing
Accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards and data subject participation. Together they cover why you may collect data, how long you keep it, how you protect it and what people can ask of you.
Appoint and register an Information Officer
Every organisation has an Information Officer (by default the head of the business). The Information Officer is responsible for compliance, handles requests and engages the Information Regulator. Registration is done with the Regulator, which runs an online portal for this.
Protect personal information with appropriate safeguards
Take reasonable technical and organisational measures against loss, damage and unauthorised access. Operators must be bound by a written contract that requires them to protect the data too.
Report security compromises
If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, you must notify the Information Regulator and the affected people as soon as reasonably possible. The Regulator publishes a prescribed notification form (SCN1) and guidance.
Respect people's rights
People can ask what you hold about them, ask for corrections or deletion, and object to processing, including direct marketing. You need a process and time to answer.
Be careful with special information, children's data and transfers abroad
Special personal information (such as health, biometrics, religion or criminal behaviour) and the data of children have stricter rules. Sending personal information outside South Africa is only allowed under specific conditions.
Keep a PAIA manual
The related Promotion of Access to Information Act requires private bodies to publish a manual describing the records they hold and how to request access.
How to comply, step by step
- Map your personal information. List what personal information you hold, where it lives, who can see it, why you collected it and how long you keep it. Everything else depends on this.
- Appoint and register your Information Officer. Document the appointment, train them and register them with the Regulator.
- Write the core documents. A privacy notice, internal data protection policy, retention schedule, PAIA manual and an incident response plan. ComplianceDesk's template library gives you starting points for each.
- Fix your contracts. Put operator agreements in place with every supplier that processes personal information for you.
- Secure the data. Access controls, encryption, backups, patching and staff training. Keep evidence that these controls run.
- Practise your breach response. Know who decides whether an incident is notifiable, how you contact the Regulator and affected people, and how you record the outcome.
- Review every year. Re-run the data map, check retention, review operators and refresh training. Record each review as evidence.
Key dates
- Information Officer registration: The Regulator stated in 2021 that it would not set a deadline, but registration remains an obligation. The online registration portal went live on 31 August 2022.
- PAIA manual: Private and public bodies are required to have a PAIA manual in place. Earlier exemption periods have ended.
What happens if you don't comply
POPIA provides for criminal offences (section 107) and administrative fines imposed by the Information Regulator (section 109). The Regulator has issued penalties in practice, including a reported R100,000 penalty against Lancet Laboratories relating to a security compromise and late notification. Check the Act and current Regulator notices for the exact limits that apply to your situation.
Common mistakes
- Treating POPIA as an IT project instead of a business-wide process.
- Not registering the Information Officer, or leaving the role with someone who doesn't know they hold it.
- Using suppliers (payroll, email marketing, cloud storage) without a written operator agreement.
- Keeping personal information forever because nobody owns the retention schedule.
- Having no tested process for notifying the Regulator and affected people after a breach.
- Sending marketing without valid consent or a working opt-out.
Related laws and frameworks
Sources and review status
Compiled from the public sources below. It is not legal advice and has not been reviewed by a lawyer. Last researched 2026-10-31. This is general information, not legal advice. Laws change, so check the current text and the regulator's notices before relying on it.
- Information Regulator (South Africa)
- Data breach reporting responsibilities and penalties in South Africa (Polity, Jan 2026)
- Information Regulator publishes prescribed form for reporting data breaches (Moonstone)
- Information Regulator on deadline for registration of Information Officers (gov.za)
- POPIA, PAIA online portals go live (SAnews)
Every POPIA control, organised for you
The real control library ComplianceDesk seeds the moment you activate POPIA — 22 controls across 9 categories.
Accountability
- POPIA-1.1 Information officer appointed
- POPIA-1.2 Compliance framework documented
Processing Limitation
- POPIA-2.1 Lawful and minimal processing
- POPIA-2.2 Consent or other justification recorded
- POPIA-2.3 Collection directly from data subject
Purpose Specification
- POPIA-3.1 Purpose specified at collection
- POPIA-3.2 Retention and disposal policy
Further Processing Limitation
- POPIA-4.1 Compatibility assessment for new uses
Information Quality
- POPIA-5.1 Data accuracy controls
Openness
- POPIA-6.1 Processing register maintained
- POPIA-6.2 Privacy notice provided to data subjects
Security Safeguards
- POPIA-7.1 Technical and organisational security measures
- POPIA-7.2 Operator agreements in place
- POPIA-7.3 Security compromise notification procedure
Data Subject Participation
- POPIA-8.1 Access request process
- POPIA-8.2 Correction and deletion request process
Special Processing & Cross-Border Transfers
- POPIA-9.1 Special personal information processing restricted
- POPIA-9.2 Children's personal information safeguarded
- POPIA-9.3 Prior authorisation obtained for higher-risk processing
- POPIA-9.4 Direct marketing consent and opt-out honoured
- POPIA-9.5 Cross-border transfer safeguards documented
- POPIA-9.6 Automated decision-making safeguards
Frequently asked questions
Does POPIA apply to a small business?
Yes. There is no size exemption. If you process personal information, such as customer or employee details, POPIA applies, although the Regulator may expect different effort from different organisations.
Who is the Information Officer?
By default the head of a private body (for example the CEO or sole owner). The role can be delegated to a deputy, but the head remains accountable. The officer must be registered with the Information Regulator.
Do I have to report every data breach?
You must notify the Regulator and affected people where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. Notification should happen as soon as reasonably possible after discovery, and the Regulator provides a prescribed form.
Do I need consent to process personal information?
Consent is one of several lawful justifications. Others include performing a contract, complying with a legal obligation and legitimate interests. Direct electronic marketing has its own consent rules.
What is the difference between POPIA and PAIA?
POPIA protects personal information. PAIA is about people's right to request access to records held by public and private bodies. Businesses commonly need to comply with both.
How does ComplianceDesk help with POPIA?
It gives you a ready-made control library covering the conditions, assigns owners and due dates, stores evidence such as your data map, registrations and contracts, and produces reports you can show a client or regulator.
How many controls does ComplianceDesk track for POPIA?
22, organised into 9 categories, ready to assign to an owner as soon as you activate the framework.
Can I track POPIA alongside other frameworks?
Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.
How long does it take to set up POPIA in ComplianceDesk?
Activating POPIA instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.
Related guides
- Kenya's Data Protection Act: What Businesses Need to Know →
- Nigeria's NDPA vs South Africa's POPIA: Comparing Africa's Two Major Data Protection Laws →
- GDPR vs POPIA: Key Differences for Businesses Operating Across Africa and Europe →
- POPIA Compliance Checklist: A Practical Guide for South African Businesses →
Other South Africa frameworks
See your full compliance picture
193 frameworks, one system of record.