Sign in

POPIA

Protection of Personal Information Act 4 of 2013 — Information Regulator (South Africa)

Also known as: POPI Act, Protection of Personal Information Act, Act 4 of 2013, South Africa POPIA 2013

Official site Official change log Subscribe to POPIA (RSS)

Current version
Protection of Personal Information Act 4 of 2013
Published 26 November 2013. source
Status
In force
Next deadline
None announced
Who must comply
Public and private bodies processing personal information entered in a record, if domiciled in South Africa or, if not, using automated or non-automated means in South Africa other than merely to forward information through it. source
How it is assessed
Responsible parties meet the eight conditions for lawful processing themselves and notify the Regulator and data subjects of security compromises as soon as reasonably possible. source
Authority
An Act of Parliament enforced by the Information Regulator, which issues enforcement notices and infringement notices with administrative fines. source source
Enforced by
The Regulator can impose administrative fines of up to R10 million, and the most serious offences carry up to 10 years' imprisonment; it has fined the Department of Justice and the Department of Basic Education R5 million each. source
Last change

South Africa's general data protection statute. It sets eight conditions for the lawful processing of personal information by public and private bodies, requires prior authorisation for certain high-risk processing, obliges responsible parties to notify the Regulator and data subjects of security compromises, and establishes the Information Regulator, which issues guidance notes, approves codes of conduct and serves enforcement notices.

Recent changes

  1. Info
    Information Regulator fines CJC and FNB for POPIA contraventions

    The Information Regulator has issued enforcement action against CJC and FNB, imposing fines for contraventions of POPIA. This demonstrates active enforcement of South Africa's data protection …

    Other Enforcement

  2. Info
    Information Regulator issues infringement notice to Central Johannesburg TVET College

    The Information Regulator has issued an infringement notice to Central Johannesburg TVET College for violations of the Protection of Personal Information Act (POPIA). The college failed …

    Other Enforcement

  3. Info
    Information Regulator issues enforcement notice to First National Bank

    The Information Regulator of South Africa has issued an enforcement notice to First National Bank regarding compliance violations. This enforcement action requires the bank to take …

    Other Enforcement

  4. Info
    Information Regulator issues infringement notice to First National Bank

    The Information Regulator of South Africa has issued an infringement notice to First National Bank for alleged breaches of the Protection of Personal Information Act. The …

    Other Enforcement

  5. Low
    POPIA Rules of Procedure specifications released

    The Information Regulator has released specifications for the POPIA Rules of Procedure, establishing detailed procedural guidelines for data protection compliance and enforcement in South Africa. These …

    New document

Key dates

No upcoming dates
  1. Information Regulator issues a R5 million administrative fine to the Department of Basic Education
  2. Information Regulator issues a R5 million administrative fine to the Department of Justice and Constitutional Development
  3. Section 58(2), on prior authorisation for high-risk processing, commences
  4. Sections 110 and 114(4) commence
Show 2 earlier dates
  1. The substantive provisions of POPIA (sections 2 to 38, 55 to 109, 111 and 114(1) to (3)) commence
  2. Section 1, the provisions establishing the Information Regulator and sections 112 and 113 commence

Amendments

  1. Protection of Personal Information Act 4 of 2013 Major versionCurrent text

    The Act was published in Government Gazette No. 37067 of 26 November 2013 and commenced in stages from 2014 to 2021. source

Who it applies to

POPIA applies to responsible parties, public or private, domiciled in South Africa or using means in South Africa to process personal information kept in records.

Records
The Act applies to processing of personal information entered in a record by automated or non-automated means; non-automated records must form part of a filing system (section 3(1)(a)). source
Outside South Africa
A responsible party not domiciled in South Africa is covered if it uses automated or non-automated means in South Africa, unless only to forward information through the country (section 3(1)(b)). source
Prior authorisation
Some processing needs the Regulator's prior authorisation, such as credit reporting or transferring special personal information or children's information to a country without adequate protection (section 57). source

How compliance is assessed

Responsible parties meet the eight conditions for lawful processing themselves and notify the Regulator and data subjects of security compromises as soon as reasonably possible.

Conditions
Processing must meet eight conditions: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation (section 4). source
Security compromises
Where personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Regulator and the data subject as soon as reasonably possible after discovery (section 22). source

Enforcement and penalties

The Regulator can impose administrative fines of up to R10 million, and the most serious offences carry up to 10 years' imprisonment; it has fined the Department of Justice and the Department of Basic Education R5 million each.

Administrative fine up to R10 million

Section 109(2)(c). source

Fine or up to 10 years

Section 107(a), for offences including obstructing the Regulator, failing to comply with an enforcement notice and unlawful acts concerning account numbers. source

Fine or up to 12 months

Section 107(b), for offences under sections 59, 101, 102, 103(2) and 104(1). source

Infringement notices
Where a responsible party is alleged to have committed an offence, the Regulator may deliver an infringement notice stating an administrative fine; within 30 days of service the infringer may, among other options, pay it or arrange to pay in instalments (section 109). source

Recent fines

  1. R5 million

    Department of Basic Education, for failing to comply with an enforcement notice on publishing matric results in newspapers. source

  2. R5 million

    Department of Justice and Constitutional Development, for failing to comply with an enforcement notice requiring renewal of its anti-virus, SIEM and intrusion detection licences. source

Documents

  1. Law text Protection of Personal Information Act 4 of 2013 (Government Gazette No. 37067)
  2. Law text POPIA on gov.za, with commencement dates
  3. Guidance Information Regulator — POPIA guidance notes and codes of conduct

Frequently asked questions

What is the maximum POPIA fine?

An administrative fine of up to R10 million through an infringement notice (section 109), and for the most serious offences a fine or imprisonment of up to 10 years (section 107). source

When did POPIA come into force?

Most provisions commenced on 1 July 2020; sections 110 and 114(4) followed on 30 June 2021 and section 58(2) on 1 July 2021. source

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to POPIA (RSS)