POPIA's regulations prescribe forms for the main things a person can do under the Act: object to processing, ask for correction or deletion, consent to direct marketing, complain, and for a business to tell the Regulator about a security compromise. People often use the wrong form, or none, because the forms are published on the Regulator's website under names that are easy to mix up with PAIA's forms. This guide explains what each one is for, who completes it and who receives it.
General information compiled from public sources, not legal advice. The Regulator published the forms in 2018 and amended the regulations in 2025, and some PDFs sit under older paths. Always download the current version from inforegulator.org.za/popia-forms rather than from a copy someone sent you. We link to the Regulator's page instead of copying the forms so you always get the current ones.
A common confusion: POPIA Form 2 is not PAIA Form 2
Both Acts have forms with numbers. PAIA's forms deal with requests for access to records (see our guide to the PAIA manual). POPIA's forms deal with personal information. When someone says "fill in Form 2" check which Act they mean. In this guide, every form number is a POPIA form unless stated.
Form 1: objection to processing
A data subject uses Form 1 to object to the processing of their personal information. POPIA section 11(3) lets a person object, on reasonable grounds, where the processing is based on their legitimate interests or the responsible party's legitimate interests, or where it is for direct marketing. Once the objection is made, the business must stop processing for that purpose unless it has a different lawful ground that still applies.
- Who completes it: the person whose information it is (or someone authorised for them).
- Who receives it: the business, through its Information Officer. Not the Regulator.
- What the business does: record the date received, assess whether the objection is valid, stop the processing it covers, and answer in writing.
Form 2: correction or deletion
Section 24 lets a person ask a business to correct information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, and to destroy or delete information the business is no longer entitled to keep. Form 2 is how they ask.
- Who completes it: the data subject.
- Who receives it: the business's Information Officer.
- What the business does: correct or delete, or give a credible reason it cannot (for example a legal retention duty) and note the disagreement. Tell anyone the information was passed to if it affects them and it is practicable.
Form 3: application for a code of conduct
Form 3 is used by bodies that want the Regulator to issue a code of conduct for a sector. It is not a form an ordinary business or individual will complete. It is relevant only if you represent an industry body.
Form 4: consent to direct marketing
Section 69 of POPIA bans unsolicited direct marketing by electronic communication unless the person has consented, or is an existing customer, and the marketing is for the business's own similar products with an easy way to opt out. The regulations provide Form 4 as the prescribed way to ask for consent, and a person who has not yet been approached can be approached only once, and only if they have not previously refused.
- Who completes it: the person being asked to consent.
- Who keeps it: the business, as evidence of consent. If you ever need to prove consent, this record is what you will be asked for.
- Practical point: keep consent records by name, date, channel and what was agreed, and honour opt-outs immediately.
Form 5: complaint to the Regulator
A person who believes a business has interfered with their personal information, or who is unhappy with how it handled a request, can complain to the Regulator on Form 5. The Regulator may investigate, try to resolve it, and where needed issue an enforcement notice. A business that gets a complaint should respond fully and keep its own file of the request and what it did.
A complaint to the Regulator does not remove a person's right to go to court, and it is not required before going to court.
SCN1: notification of a security compromise
Section 22 of POPIA requires a responsible party that has reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person to notify the Regulator and the affected data subjects, as soon as reasonably possible, taking into account what is needed to find the extent of the breach and restore the system's integrity. The Regulator publishes the notification form it expects, referred to as SCN1.
- Who completes it: the business (the responsible party), not the data subject.
- Who receives it: the Information Regulator, and the affected people are told separately.
- Note: POPIA does not set a fixed number of hours. Many businesses set an internal deadline, and operators usually agree a short one with their customers.
How a business should run this
- Name one mailbox for requests (such as privacy@yourdomain) and put it in your privacy notice and PAIA manual.
- Link the official forms from a page on your website rather than hosting copies.
- Keep a request log: who asked, which form, when it arrived, what you decided and when you replied. Set your own response standard (30 days is a sensible default) and track it.
- Train staff and contractors to forward anything that looks like a request to the Information Officer the same day.
- Review the forms page at least once a year in case the Regulator has changed anything.
ComplianceDesk's templates include a data breach response plan, a direct marketing policy and a POPIA privacy notice that all point to these forms, and its calendar can remind you to review them.