South Africa's POPIA Regulation

What Is the Purpose of POPIA?

South Africa’s Protection of Personal Information Act (POPIA) aims to give the citizens of South Africa more control over their data and require that organizations do more to protect the personal data they process.

Under the law — which became enforceable on July 1, 2021 — “processing” personal information includes collecting, receiving, recording, organizing, retrieving, using, disseminating, distributing, or making it available.

POPIA Regulamentos

Among other data privacy and protection measures, POPIA:

gives South African data subjects nine actionable, enforceable rights over their personal information — including the rights to access, correction, and deletion
requires that companies follow eight minimum requirements for data processing (e.g., requiring consent as a legal basis)
creates a broad definition of personal
information
establishes the enforcement and supervisory body South African Information Regulator (SAIR), with broad powers to investigate and fine responsible parties

Who Does POPIA Apply To?

POPIA applies to any organization that:

processes personal information in South Africa
is domiciled in South Africa
is not domiciled in South Africa but that
processes personal information in South Africa

Unlike GDPR, which requires compliance of any organization that processes personal data of data subjects within the EU, POPIA requires compliance of any organization that processes personal information within the country.

What Is Considered Personal Data Under POPIA?

POPIA defines personal information broadly, as “any information relating to not only a living person but also a company or legal entity.”

However, in a point of ambiguity that could lead to enforcement difficulties and possible abuses, POPIA also allows companies to process data if it’s deemed in the user’s “legitimate interest.”

Companies who are noncompliant with POPIA can face fines of up to 10 million ZAR — and even criminal penalties and prison time.

What Is the Difference Between GDPR and POPIA?

While POPIA is modeled after GDPR, there are some key differences between the South African and EU laws. They include:

POPIA protects companies as “juristic persons,” while GDPR only protects individuals
POPIA focuses on the location of processing rather than the location of the data subject (GDPR).
POPIA requires companies to appoint an Information Officer and Deputy Information Officer, whose roles differ from the GDPR’s Data Protection Officer
POPIA requires breach notification within a reasonable time period — and GDPR within 72 hours
POPIA requires DSAR response within a reasonable time frame — and GDPR with a month at the most.