POPIA: South Africa's Data Protection Law

What is POPIA?

The Protection of Personal Information Act (POPIA) is South Africa's comprehensive data protection law, with its main provisions fully effective since July 2021. Its territorial scope is not based on citizenship: it applies where the responsible party is domiciled in South Africa or, subject to a forwarding-only exception, uses processing means in South Africa.

POPIA creates a South African accountability framework with its own scope, processing conditions, rights, regulator, and enforcement model; GDPR terminology should not be copied across without checking the Act.

Eight Processing Conditions

Accountability: The responsible party must ensure compliance and take measures to adhere to the conditions.

Processing limitation: Personal information must be processed lawfully and in a manner that does not infringe on the data subject's privacy.

Purpose specification: Information must be collected for a specific, explicitly defined, and lawful purpose.

Further processing limitation: Processing must be compatible with the purpose for which it was collected.

Information quality: Reasonably practicable steps must keep personal information complete, accurate, and not misleading.

Openness: Processing must be documented and data subjects must receive the required collection notice.

Security safeguards: Appropriate technical and organizational measures must protect the information.

Data subject participation: People have rights to access and, where applicable, correct or delete their information.

Consent Under POPIA

Consent is one justification under POPIA, not a universal requirement for all processing. Where it is relied on, the responsible party bears the burden of proof and the person may withdraw it, without affecting earlier lawful processing. Direct marketing by electronic communication has additional rules. A CMP can help with website choices and evidence, but it does not cover the full set of POPIA duties.