POPIA South Africa: Complete Compliance Guide

Any 'responsible party' domiciled in South Africa, or domiciled abroad but using automated or non-automated means in South Africa (unless only forwarding data through the country), processing 'personal information', defined broadly and extending to juristic persons, so B2B data about companies is protected, a rare feature globally. Exclusions cover purely personal activity, de-identified data, certain state security and journalism functions. The juristic-person coverage means South African compliance sweeps in CRM and procurement databases that GDPR-modeled programs treat as out of scope.

They function like GDPR principles with local vocabulary: accountability (governance and the information officer), processing limitation (lawfulness, minimality, consent or another justification such as contract, legal obligation, or legitimate interest), purpose specification (defined, documented purposes and retention limits), further processing limitation (compatibility test), information quality (accuracy duties), openness (notification to data subjects and a PAIA manual), security safeguards (appropriate measures, processor contracts, breach notification 'as soon as reasonably possible' to the Regulator and data subjects), and data subject participation (access, correction, deletion rights). Programs organize their POPIA gap analyses condition by condition; the Regulator's enforcement notices cite them the same way.

POPIA defaults the role to the head of the organization, the CEO or equivalent, who may delegate to deputy information officers but keeps accountability. Duties: encourage and ensure compliance, handle data subject requests, work with the Regulator, develop and implement a compliance framework, conduct assessments, and maintain the PAIA manual. Registration with the Information Regulator is required before taking up duties (the Regulator's portal handles it). This design puts executive skin in the game deliberately: the compliance officer is not a mid-level appointee but the accountable head, and the Regulator addresses enforcement correspondence accordingly.

Section 57 lists it: processing unique identifiers for purposes beyond their original intent with intent to link across responsible parties; processing criminal, credit-reporting, or unlawful-behavior information on behalf of third parties; transferring special personal information or children's information to countries without adequate protection; and processing for specified research/statistical linkage. Processing must not begin until the Regulator has decided (or the statutory period lapses). Credit bureaus, background-check firms, and data brokers are the paradigm applicants; ordinary controllers mostly need only to check the list and document the negative.

More active than most African peers. The Information Regulator has issued enforcement notices against Experian (following the 2020 breach affecting millions of South Africans), the Department of Justice and Constitutional Development (fined R5 million in 2023 after ransomware, the first administrative fine, notably against a state body), WhatsApp (ordering equal treatment of South African users), and others, plus infringement notices over direct-marketing violations. The ceiling is R10 million per administrative fine, with criminal exposure (up to 10 years' imprisonment for offenses like unlawful account-number processing) prosecutable separately. Direct marketing (Section 69's opt-in rule for electronic marketing) is the current enforcement theme.