Skip to content
Emergency helpGet started
Compliance & Governance

What is POPIA? South Africa's Protection of Personal Information Act

POPIA, South Africa's Protection of Personal Information Act 4 of 2013: who it applies to, security safeguards, breach notification and penalties.
By VigilbasePublished
Read the guideMore Topics

POPIA, the Protection of Personal Information Act 4 of 2013, is South Africa's data protection law. It sets eight conditions for the lawful processing of personal information by public and private bodies, requires security safeguards and the reporting of security compromises, and is enforced by the Information Regulator. Most of the Act commenced on 1 July 2020, with one year, to 30 June 2021, to bring existing processing into line. This guide summarizes the Act and the Regulator's published guidance, and shows where security operations evidence helps.

Who does POPIA apply to?

POPIA applies to the processing of personal information entered in a record by or for a responsible party, by automated or non-automated means. A responsible party is a public or private body, or any other person, that determines the purpose of and means for processing. The Act applies when the responsible party is domiciled in South Africa, or is not domiciled there but uses automated or non-automated means in South Africa, unless those means are used only to forward personal information through the country.
1.Personal information is information about an identifiable, living natural person and, where applicable, an identifiable, existing juristic person, so information about companies can be covered too.
2.An operator processes personal information for a responsible party under a contract or mandate, without coming under its direct authority.
3.Where another law sets more extensive conditions for lawful processing, those conditions prevail.

What are the eight conditions for lawful processing?

Section 4 of POPIA lists eight conditions that apply to all processing by or for a responsible party. Sections 8 to 25 set out what each condition requires.
1.Accountability: the responsible party ensures that the conditions are met.
2.Processing limitation: processing is lawful and minimal, with consent or another justification, and information is generally collected directly from the data subject.
3.Purpose specification: information is collected for a specific purpose, and records are not kept longer than necessary, subject to the exceptions in the Act.
4.Further processing limitation: further processing must be compatible with the purpose of collection.
5.Information quality: reasonably practicable steps keep information complete, accurate, not misleading and updated where necessary.
6.Openness: processing is documented, and data subjects are told when their information is collected.
7.Security safeguards: integrity and confidentiality are protected, and security compromises are notified.
8.Data subject participation: data subjects can access their information and request its correction.

What does POPIA require for information security?

Section 19 requires a responsible party to secure the integrity and confidentiality of personal information in its possession or under its control with appropriate, reasonable technical and organisational measures. Those measures must prevent loss of, damage to or unauthorised destruction of personal information, and unlawful access to or processing of it. The responsible party must have due regard to generally accepted information security practices and procedures, including any required by industry or professional rules.
1.Identify all reasonably foreseeable internal and external risks to the personal information it holds or controls.
2.Establish and maintain appropriate safeguards against the risks identified.
3.Regularly verify that the safeguards are effectively implemented.
4.Continually update the safeguards in response to new risks or deficiencies.
5.Use a written contract to require any operator to maintain the same security measures. An operator must notify the responsible party immediately if it has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

When must a security compromise be reported under POPIA?

Under section 22, where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and the affected data subjects. Notification must be made as soon as reasonably possible after the compromise is discovered, taking into account the legitimate needs of law enforcement or the measures reasonably necessary to determine its scope and restore the integrity of the information system. Notifying data subjects may be delayed only if a public body responsible for investigating offences, or the Regulator, determines that notification will impede a criminal investigation.
1.Notify data subjects in writing: by post, by email, in a prominent position on your website, in the news media, or as the Regulator directs.
2.Give enough information for data subjects to protect themselves: the possible consequences, the measures you have taken or intend to take, what they should do, and the identity of the unauthorised person if known.
3.The Regulator's step-by-step guide explains how to report a security compromise on its eServices Portal. The organisation and its Information Officers must be registered there, and the form asks for the incident details, how data subjects were notified, the impact and the remedial actions taken.
4.Supporting documents such as internal investigation reports and forensic findings can be uploaded with the report.

What does an Information Officer do?

Every public and private body has an Information Officer. Under section 55, the Information Officer encourages compliance with the conditions for lawful processing, deals with requests made under POPIA, and works with the Regulator on investigations. Information Officers may take up their duties only after the responsible party has registered them with the Regulator, which is done on its eServices Portal. The Regulator's guidance adds duties under the POPIA regulations, including a compliance framework and a personal information impact assessment.

What are the penalties under POPIA?

The Information Regulator can serve an infringement notice with an administrative fine of up to R10 million. When it sets the amount, the factors it must consider include the number of data subjects affected, the likelihood of substantial damage or distress, and any failure to carry out a risk assessment or to operate good policies, procedures and practices to protect personal information. Some offences, such as obstructing the Regulator or failing to comply with an enforcement notice, carry a fine, imprisonment of up to 10 years, or both. A data subject, or the Regulator at a data subject's request, can also bring a civil action for damages.

Can personal information be transferred outside South Africa?

Under section 72, a responsible party may transfer personal information to a third party in a foreign country only on the grounds the Act sets out. These include a recipient bound by a law, binding corporate rules or a binding agreement that provides an adequate level of protection, the data subject's consent, or a transfer necessary for a contract with the data subject. Check these grounds before you route logs or security data containing personal information to services outside South Africa.

How Vigilbase supports POPIA work

Vigilbase does not make an organization POPIA compliant, and it does not replace your Information Officer. It helps you operate some of the security safeguards that section 19 describes, and produce evidence that they are monitored and verified. This guide summarizes the Act and the Information Regulator's published guidance. It is not legal advice: your Information Officer and legal advisers decide what POPIA requires of your organization.
1.Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place, which helps you identify risks and check that safeguards are working.
2.The Vigil agent investigates high-severity incidents, and each investigation records the evidence, the actions taken and the verification result. That record helps your Information Officer assemble the facts a security compromise report needs.
3.Managed Cloudflare runs WAF, DDoS, bot and DNS controls on the agreed scope, with configuration, change history and incident notes kept for review.
4.Default retention is set per dataset, typically 30 to 90 days. If you must keep records longer, decide where that archive lives before you consolidate.

Key Takeaways

✓POPIA (Act 4 of 2013) governs how public and private bodies process personal information in South Africa, and the Information Regulator enforces it.
✓Section 19 requires appropriate, reasonable technical and organisational safeguards that are regularly verified and kept up to date.
✓Security compromises must be reported to the Regulator and affected data subjects as soon as reasonably possible after discovery.
✓Information Officers must be registered with the Regulator before they take up their duties.
✓Vigilbase helps you operate and evidence security safeguards; it does not certify compliance.

Sources

Related Solutions

Vigilbase services related to this guide

Managed SOC

Learn more

Managed Cloudflare

Learn more

Vigilbase OS

Learn more

Managed Cloudflare in South Africa

Learn more

Cloudflare Enterprise in South Africa

Learn more

Frequently Asked Questions

What is POPIA?

POPIA is the Protection of Personal Information Act 4 of 2013, South Africa's data protection law. It sets conditions for the lawful processing of personal information by public and private bodies, gives data subjects rights over their information, and established the Information Regulator to enforce it.Privacy and data handling

Is the POPI Act the same as POPIA?

Yes. POPIA and the POPI Act are both short names for the Protection of Personal Information Act 4 of 2013.

Who enforces POPIA?

The Information Regulator (South Africa), an independent body established under section 39 of POPIA. It is accountable to the National Assembly and also enforces the Promotion of Access to Information Act (PAIA).

When did POPIA come into effect?

The sections that established the Information Regulator commenced on 11 April 2014. Most of the Act, including the conditions for lawful processing, commenced on 1 July 2020, and existing processing had to conform within one year, by 30 June 2021.

How quickly must a POPIA security compromise be reported?

As soon as reasonably possible after it is discovered. Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and the affected data subjects.Notifying data subjects may be delayed only if a public body responsible for investigating offences, or the Regulator, determines that notification will impede a criminal investigation.Security operations responsibilitiesWhat a SIEM does

What are the penalties for breaching POPIA?

The Information Regulator can issue an administrative fine of up to R10 million. Some offences, such as failing to comply with an enforcement notice, carry a fine, imprisonment of up to 10 years, or both.

Can Vigilbase make us POPIA compliant?

No. Vigilbase helps you operate and evidence security safeguards: connected logs stay queryable, investigations record the evidence, actions and verification, and Managed Cloudflare keeps change history and incident notes. Your Information Officer and legal advisers decide what POPIA requires of you.Get started with Vigilbase OSSecurity documentation in the Trust Center

Related Topics

Security Basics

What is SIEM?

Security Basics

What is SOC?

Compliance & Governance

Which Managed Cloudflare tier should a financial services team buy?

Compliance & Governance

Nigeria Data Protection Act

Compliance & Governance

Kenya Data Protection Act

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning