PrivacyTerrain

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Needs refinement on administrative enforcement and responsible-party mechanics.

At a glance

Key presentation points

A compact summary of high-signal fields before the full structured record.

Effective statusin-force1 primary + 1 secondary • Reviewed 17/04/2026

Territorial scopeApplies to responsible parties domiciled in South Africa and, in some cases, to those using automated or non-automated means in South Africa.1 primary + 1 secondary • Reviewed 17/04/2026

Regulator or enforcement authority summaryInformation Regulator1 primary • Reviewed 17/04/2026

Requires legal basisYes1 primary + 1 secondary • Reviewed 17/04/2026

Structured record

Regulation details grouped by topic

Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.

Identity

Effective status: in-forceSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Law status: activeSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Effective date: 2021-07-01Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Last amended: 2021-07-01Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Scope

Extraterritorial application: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Territorial scope: Applies to responsible parties domiciled in South Africa and, in some cases, to those using automated or non-automated means in South Africa.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Private sector coverage: Applies broadly to responsible parties in the private sector.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Public sector coverage: Public bodies are also covered, subject to limited exclusions.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Definitions

Personal data definition: Personal information means information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Sensitive data recognized: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Legal Basis

Legal bases: consent, contract, legal obligation, legitimate interestsSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Requires legal basis: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Rights

Right of access: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to deletion: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to object: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to portability: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to appeal: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to erasure or delete summary: Deletion / destruction rightsSupport: 1 primary • Reviewed 17/04/2026Sources: POPIA text (primary)Note: POPIA is better summarized through deletion and destruction language than a single imported erasure label.
Right to rectification or correction summary: Correction rightSupport: 1 primary • Reviewed 17/04/2026Sources: POPIA text (primary)Note: South Africa includes correction-related rights within POPIA's rights framework.

Breach

Breach deadline (hours): 0Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Breach notification required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Governance

DPO required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Impact assessment required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Records of processing required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Enforcement

Maximum fine: Administrative fines can reach ZAR 10 million, alongside criminal sanctions for some offenses.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Private right of action: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Regulator or enforcement authority summary: Information RegulatorSupport: 1 primary • Reviewed 17/04/2026Sources: POPIA text (primary)Note: South Africa's privacy oversight centers on the Information Regulator.

Transfers

Cross-border transfer restricted: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Data localization required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Marketing

Cookie consent rule: Cookie and tracking analysis follows consent, purpose limitation, and direct marketing rules.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: POPIA text (primary); Information Regulator guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Official sources

POPIA textPrimary official law • en • html
Information Regulator guidanceSecondary official material • en • html

South Africa