South African Cyber Guide
POPIA and your personal information
What is it?
The Protection of Personal Information Act (POPIA) is South African legislation that governs how organisations must collect, use, and protect your personal information.
How does it work?
POPIA gives you rights over how your information is handled and requires responsible parties to protect personal information. When a security compromise occurs, the responsible party has reporting and notification obligations to the Information Regulator and affected data subjects.
How do I recognise it?
- A company you use should have a privacy policy explaining what data it collects and why.
- You have the right to ask an organisation what personal information they hold about you.
- You should be notified if a company's data breach affects your information.
What should I do?
- Read the privacy policy of services that hold sensitive information about you.
- Ask a company directly what data they hold about you if you're unsure.
- Report a company to South Africa's Information Regulator if you believe your rights under POPIA were violated.
What should I avoid?
- Don't assume a company automatically has the right to share your data with third parties without basis.
Where can I get help?
- The Information Regulator (South Africa), for POPIA-related complaints.