Summary: South Africa's Protection of Personal Information Act sets rules for collecting and using personal information. Here is what it means for your website.
The Protection of Personal Information Act (POPIA) applies to organisations processing personal information in South Africa. This is general guidance, not legal advice.
Key conditions
- Process information lawfully and for a specific purpose
- Collect only what you need
- Keep information accurate and secure
- Be open about how information is used
- Respect data subjects' rights
Direct marketing
Electronic direct marketing generally requires consent, except for existing customers in certain circumstances, and must include an opt-out.
Information officer
Organisations must have an information officer registered with the Information Regulator.
Website steps
Update your privacy notice, add consent to forms and secure form submissions.
FAQs
Does POPIA apply to small businesses?
Yes, it applies to most organisations processing personal information.
Can we use overseas tools?
Yes, with appropriate safeguards for cross-border transfers.
Who enforces POPIA?
The Information Regulator.
