Upgrade to a premium account to save this to your customizable Workspace
Create an account
Join our community for free to access exclusive whitepapers, reports, and regulatory information.
POPIA
Comply with POPIA
South Africa's Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA') was promulgated into law on 26 November 2013, following the President's signature. A period of relative stasis then followed for several years while a commencement date for the key provisions was decided upon. The Information Regulator ('the Regulator'), the data protection authority provided for by POPIA was established during this time and held its first meeting late in 2016, although its operations were limited.
The Regulator announced, on 1 July 2021, that its enforcement powers under POPIA are into effect from 1 July 2021, following the conclusion of the 12-month transition period for compliance as provided under Section 110 of POPIA.
POPIA is further supported by the Regulations Relating to the Protection of Personal Information (2018), which establish additional provisions on the application of POPIA and contain several template forms.
OneTrust DataGuidance's POPIA Portal provides you with the ability to track developments regarding POPIA and understand its obligations.
POPIA v. GDPR
OneTrust DataGuidance have produced a POPIA v. GDPR report which you can download here, and which assists organisations in understanding and comparing key provisions of the POPIA comparative to the GDPR. You can also leverage this information through our GDPR v. POPIA Comparison in the tab above.
South Africa Privacy Landscape Overview
Watch our South Africa Overview video to understand the state of privacy in South Africa today.
The Information Regulator ('the Regulator') published, on 22 April 2022, a media statement in which it announced that it would monitor the National Department of Health's ('NDoH') compliance with the Protection of Personal Information Act, 2013 ('POPIA'), following the decision from President Cyril Ramaphosa to lift the national state of disaste
The Information Regulator ('the Regulator') released, on 25 March 2022, a media statement in which it expressed its dissatisfaction with the security compromise notification from Trans Union LLC., following a security compromise affecting millions of data subjects.
The Information Regulator ('the Regulator') released, on 12 January 2022, a media statement addressing the Department of Basic Education ('DBE') regarding the processing of personal information in the form of matric results to ensure compliance with the Protection of Personal Information Act, 2013 ('POPIA').
The Information Regulator ('the Regulator') announced, on 2 December 2021, that the President of South Africa HE., Cyril Ramaphosa, appointed four members to the Regulator, effective from 1 December 2021.
The Information Regulator ('the Regulator') published, on 13 October 2021, rules of procedure ('the Rules') relating to the manner in which a complaint must be submitted and handled by the Regulator, pursuant to Section 40 of the Protection of Personal Information Act, 2013 ('POPIA'), outlining the Regulator's duties and functions.
The Information Regulator ('the Regulator') announced, on 15 October 2021, that it had published, on 12 October 2021, in the Government Gazette, the Code of Conduct governing the Conditions for Lawful Processing of Personal Information by members of the Credit Bureau Association ('CBA'), South Africa, in terms of Section 61(2) of the Protection
The Information Regulator released, on 14 October 2021, a media statement addressing political parties and independent candidates campaigning for local government elections, taking place on 1 November 2021, to ensure lawful processing of voters' personal data.
The Information Regulator ('the Regulator') announced, on 13 October 2021, that it had extended the period for comment on Protection of Personal Information Act, No.4 of 2013 ('POPIA'): Amendment of the Regulations Relating to the Protection of Personal Information, 2018.
The Information Regulator ('the Regulator') announced, on 15 October 2021, that it had changed its email addresses for service requests and enquiries. In particular, the Regulator noted that its email system will now operate under a new domain to ensure accessibility to the public and to stakeholders.
The White House issued, on 14 October 2021, a joint statement with world Ministers and Representatives following the ransomware initiative meeting held on 13 and 14 October 2021.
The Information Regulator released, on 12 October 2021, its Guide on How to Use the Promotion of Access to Information Act (Act 2 of 2000) ('PAIA').
The Information Regulator ('the Regulator') published, on 21 September 2021, the pledge of its Chief Executive Officer, Mr M. Mosala, signed on 14 September 2021, relating to enterprise-wide risk management and compliance.
The Information Regulator ('the Regulator') released, on 13 September 2021, a media statement in which it announced that its IT systems had been affected by a ransomware attack on the Department of Justice & Constitutional Development ('DOJ&CD').
The Information Regulator ('the Regulator') released, on 2 September 2021, forms relating to the Promotion of Access to Information Act, 2000 (Act No. 2 of 2000) (as amended) ('PAIA'), including Form 5 of the same and PAIA Manual Templates, one for public bodies and one for private bodies.
Form 5
The Information Regulator ('the Regulator') published, on 2 August 2021, in accordance with Section 61(2) of the Protection of Personal Information Act, No. 4 of 2013 ('POPIA'), that it had received a code of conduct from Maktaba Stationery TA PNA, a stationery retail company.
The Information Regulator ('the Regulator') published, on 22 July 2021, Form 5 of the Regulations relating to the Protection of Personal Information, 2018 which support the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ('POPIA').
During December 2021, the South African President signed the Cybercrimes Act, 2020 (Act 19 of 2020) ('the Cybercrimes Act') into law. This legislation is the first in South Africa to consider cybercrimes explicitly, and forms part of South Africa's growing legislative framework on data management.
In order to process certain categories of data, South African organisations require 'prior authorisation' from the national Information Regulator ('the Regulator') in terms of the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA').
The South Africa Credit Bureau Association ('CBA') has published a Code of Conduct1 ('the Code') governing the Conditions for Lawful Processing of Personal Information by credit bureaus who are members of the CBA under the Protection of Personal Information Act, No.4 of 2013 ('POPIA').
The Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA') requires a responsible party to apply for and obtain authorisation prior to processing certain identified categories of personal information.
The effective date for South Africa's data privacy law, the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA') is fast approaching and in anticipation of D-Day (1 July 2021), organisations need to address their compliance requirements to avoid possible penalties.
The Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA') defines a number of different persons who may either, in the circumstances, be involved in and/or responsible for the processing and protection of personal data or alternatively, are the persons to whom such personal data relates.
Under South African law, direct marketing is not solely regulated by the Protection of Personal Information Act, 2013 (Act 4 of 2013) ('POPIA') but is affected by other pieces of legislation too, such as the Consumer Protection Act, 2008 (Act 68 of 2008) ('CPA') and the Electronic Communications and Transactions Act, 2002 (Act 25 of 2002) ('ECTA
By now the news of the commencement date (i.e. 1 July 2020) for the Protection of Personal Information Act No.
POPIA v GDPR
GDPR Benchmark
This Chart aims at assisting organisations in understanding and comparing key provisions of the GDPR with relevant data protection law from around the globe. This Chart provides a comparison of the following key provisions:
- Scope
- Definitions and legal basis
- Rights
- Enforcement
Each topic includes relevant articles and sections from the law compared, a summary of the comparison, and a detailed analysis of the similarities and differences. The degree of similarity for each section can be identified using the key.
Scope Benchmark
- title
- Personal scope
- Territorial scope
- Material scope
Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Definitions and Legal Basis Benchmark
- title
- Personal data
- Pseudonymisation
- Controller and processor
- Children
- Research
- Legal Basis
Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Rights Benchmark
- title
- Right to deletion
- Right to be informed
- Right to object
- Right to access
- Right not to be subject to discrimination
- Right to data portability
Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Enforcement Benchmark
- title
- Monetary penalties
- Supervisory authority
- Civil remedies
Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
