Upgrade to a premium account to save this to your customizable Workspace
Create an account
Join our community for free to access exclusive whitepapers, reports, and regulatory information.
POPIA
Comply with POPIA
South Africa's Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA') was promulgated into law on 26 November 2013, following the President's signature. A period of relative stasis then followed for several years while a commencement date for the key provisions was decided upon. The Information Regulator ('the Regulator'), the data protection authority provided for by POPIA was established during this time and held its first meeting late in 2016, although its operations were limited.
The Regulator announced, on 1 July 2021, that its enforcement powers under POPIA are into effect from 1 July 2021, following the conclusion of the 12-month transition period for compliance as provided under Section 110 of POPIA.
POPIA is further supported by the Regulations Relating to the Protection of Personal Information (2018), which establish additional provisions on the application of POPIA and contain several template forms.
OneTrust DataGuidance's POPIA Portal provides you with the ability to track developments regarding POPIA and understand its obligations.
POPIA v. GDPR
OneTrust DataGuidance have produced a POPIA v. GDPR report which you can download here, and which assists organisations in understanding and comparing key provisions of the POPIA comparative to the GDPR. You can also leverage this information through our GDPR v. POPIA Comparison in the tab above.
South Africa Privacy Landscape Overview
Watch our South Africa Overview video to understand the state of privacy in South Africa today.
The Information Regulator ('the Regulator') announced, on 20 February 2023, that it has decided to refer the National Department of Health ('NDoH') to the Enforcement Committee over the issue of certain personal information that the NDoH had collected as part of the management of the spread of COVID-19 during the pandemic, following numerous uns
The Information Regulator ('the Regulator') published, on 16 February 2023, Protection of Personal Information Act 4 of 2013 ('POPIA') Rules of Procedure Relating to the manner in which a complaint or any matter in terms of the POPIA must be referred to and considered for a finding, and recommendation by the Enforcement Committee, 2023,
The Information Regulator ('the Regulator') published, on 24 November 2022, a media statement in which it welcomed action taken by the Department of Basic Education ('DBE') to align its processes on the publication of matric results with the requirements of the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA'), notably Secti
The Information Regulator ('the Regulator') provided, on 26 October 2022, via Twitter, an update of the Regulator's recent activity and status. In particular, the Regulator outlined that the Enforcement Committee is in full force and complaints have been referred to it.
Notices in terms of Section 62(1) of the Protection of Personal Information Act, Act No.
The Information Regulator ('the Regulator') announced, on 29 August 2022, that it had issued a summons to the South African Police Service ('SAPS'), following failure to provide details related to the release of personal information of Krugersdorp victims by 24 August 2022.
The Information Regulator ('the Regulator') announced, on 12 August 2022, that it had published guidelines on how the security compromise notification form to the Regulator in terms of Section 22 of the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA') must be completed by responsible parties.
The Information Regulator ('the Regulator') released, on 5 August 2022, a media statement in which it announced that it had initiated an investigation into possible violations of the Protection of Personal Information Act (Act No. 4 of 2013) ('POPIA') by members of the South Africa Police Service ('SAPS').
The Information Regulator ('the Regulator') announced, on 28 July 2022, that it had established an Enforcement Committee in accordance with Section 50 of the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA'), which will be chaired by Advocate Helen Fourie Senior Counsel. In particular, the Regulator specified that the Commit
The Information Regulator ('the Regulator') published, on 22 April 2022, a media statement in which it announced that it would monitor the National Department of Health's ('NDoH') compliance with the Protection of Personal Information Act, 2013 ('POPIA'), following the decision from President Cyril Ramaphosa to lift the national state of disaste
The Information Regulator ('the Regulator') released, on 25 March 2022, a media statement in which it expressed its dissatisfaction with the security compromise notification from Trans Union LLC., following a security compromise affecting millions of data subjects.
The Information Regulator ('the Regulator') released, on 12 January 2022, a media statement addressing the Department of Basic Education ('DBE') regarding the processing of personal information in the form of matric results to ensure compliance with the Protection of Personal Information Act, 2013 ('POPIA').
The Information Regulator ('the Regulator') announced, on 2 December 2021, that the President of South Africa HE., Cyril Ramaphosa, appointed four members to the Regulator, effective from 1 December 2021.
The Information Regulator ('the Regulator') published, on 13 October 2021, rules of procedure ('the Rules') relating to the manner in which a complaint must be submitted and handled by the Regulator, pursuant to Section 40 of the Protection of Personal Information Act, 2013 ('POPIA'), outlining the Regulator's duties and functions.
The Information Regulator ('the Regulator') announced, on 15 October 2021, that it had published, on 12 October 2021, in the Government Gazette, the Code of Conduct governing the Conditions for Lawful Processing of Personal Information by members of the Credit Bureau Association ('CBA'), South Africa, in terms of Section 61(2) of the Protection
The Information Regulator released, on 14 October 2021, a media statement addressing political parties and independent candidates campaigning for local government elections, taking place on 1 November 2021, to ensure lawful processing of voters' personal data.
Personal data is one of the most sought-after commodities of the 21st century1, and as a result, consent has, in recent years, become increasingly prevalent as a codified legal mechanism intended to enable the informational self-determination2 of data subjects.
Sections 34 and 35 of the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA') deals with the processing of children's information.
In 2013, after a period of nine years and 11 iterations of a data protection bill being mulled over by the government, South Africa's legislature passed the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA').
While cloud services had seen small-scale uptake within South Africa prior to 2020, the national working environment was fundamentally challenged by the onset of lockdown regulations following the COVID-19 pandemic.
During December 2021, the South African President signed the Cybercrimes Act, 2020 (Act 19 of 2020) ('the Cybercrimes Act') into law. This legislation is the first in South Africa to consider cybercrimes explicitly, and forms part of South Africa's growing legislative framework on data management.
In order to process certain categories of data, South African organisations require 'prior authorisation' from the national Information Regulator ('the Regulator') in terms of the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA').
The South Africa Credit Bureau Association ('CBA') has published a Code of Conduct1 ('the Code') governing the Conditions for Lawful Processing of Personal Information by credit bureaus who are members of the CBA under the Protection of Personal Information Act, No.4 of 2013 ('POPIA').
The Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA') requires a responsible party to apply for and obtain authorisation prior to processing certain identified categories of personal information.
The effective date for South Africa's data privacy law, the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA') is fast approaching and in anticipation of D-Day (1 July 2021), organisations need to address their compliance requirements to avoid possible penalties.
POPIA v GDPR
GDPR Benchmark
This Chart aims at assisting organisations in understanding and comparing key provisions of the GDPR with relevant data protection law from around the globe. This Chart provides a comparison of the following key provisions:
- Scope
- Definitions and legal basis
- Rights
- Enforcement
Each topic includes relevant articles and sections from the law compared, a summary of the comparison, and a detailed analysis of the similarities and differences. The degree of similarity for each section can be identified using the key.
Scope Benchmark
- title
- Personal scope
- Territorial scope
- Material scope
Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Definitions and Legal Basis Benchmark
- title
- Personal data
- Pseudonymisation
- Controller and processor
- Children
- Research
- Legal Basis
Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Rights Benchmark
- title
- Right to deletion
- Right to be informed
- Right to object
- Right to access
- Right not to be subject to discrimination
- Right to data portability
Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Enforcement Benchmark
- title
- Monetary penalties
- Supervisory authority
- Civil remedies
Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
