What is POPIA and how do I comply?

POPIA (Protection of Personal Information Act) is South Africa’s data protection law that governs how organisations collect, process, store, and share personal information. It came into full effect on 1 July 2021 and applies to all businesses operating in South Africa.

Every organisation that processes personal information in South Africa must comply, regardless of size. This includes private companies, non-profits, government bodies, and even sole proprietors. International businesses processing South African data must also comply.

Non-compliance can result in fines of up to R10 million, imprisonment of up to 10 years, or both. The Information Regulator can also issue enforcement notices, order organisations to stop processing data, and award compensation to affected individuals.

Yes. Every organisation must appoint an Information Officer and register them with the Information Regulator. In many small businesses, the head of the organisation is automatically considered the Information Officer unless someone else is formally appointed.

A POPIA privacy policy is a document that explains to individuals how your organisation collects, uses, stores, and protects their personal information. It must be publicly available, typically on your website, and must be written in clear, plain language.