What Is POPIA? A Plain-English Guide to the POPI Act

The short version

POPIA is South Africa's data protection law. Its full name is the Protection of Personal Information Act 4 of 2013, and it has been fully enforceable since 1 July 2021.

It does two things. It tells organisations how they may collect and use information about people, and it gives people rights over information held about them. If a business has your name, your email address or your ID number, POPIA governs what they are allowed to do with it.

That is the whole idea. Everything below is detail.

POPI Act or POPIA? They are the same law

This confuses almost everyone, so it is worth clearing up first.

Before the law was passed it was widely called the POPI Act, short for Protection of Personal Information. After it was enacted, the accepted abbreviation became POPIA. The Information Regulator uses POPIA. Both names refer to Act 4 of 2013, and there is no legal difference between them.

You may also see it written as "the POPI Act of 2013", "POPIA 2021" (after the enforcement date) or "Act 4 of 2013". Same law every time.

What counts as personal information?

Wider than most people expect. Section 1 defines personal information as information relating to an identifiable living person, and where applicable an identifiable existing company or other legal entity.

South Africa is unusual here: POPIA protects companies too, not only individuals. Europe's GDPR protects only people.

The definition specifically includes:

• Names, contact details, and physical or postal addresses
• ID numbers, passport numbers and other identifying numbers
• Race, gender, pregnancy, marital status, ethnic origin, age, disability, religion, belief, culture and language
• Medical, financial, criminal or employment history
• Email addresses, IP addresses, cookies and other online identifiers
• Biometric information such as fingerprints or facial images
• Someone's opinion about a person, and correspondence that would reveal its contents

That last one surprises people. An internal email expressing a view about a customer is that customer's personal information.

The three roles POPIA talks about

The Act uses specific words for specific parties, and the rest of it is much easier to read once you know them.

• Data subject. The person (or company) the information is about. If a shop holds your details, you are the data subject.
• Responsible party. Whoever decides why and how the information gets processed. Usually the business itself. GDPR calls this the controller.
• Operator. Someone who processes information on behalf of the responsible party, without deciding the purpose. Your web host, payroll bureau or email platform. GDPR calls this the processor.

"Processing" is defined so broadly that it covers essentially anything you can do with data: collecting it, storing it, looking at it, sharing it, and even deleting it.

Who does POPIA apply to?

Practically every organisation in South Africa. There is no small-business exemption, no turnover threshold, and no minimum number of employees. A sole proprietor with a customer spreadsheet is a responsible party.

It applies if you are domiciled in South Africa, or if you are not but you process information here using local means. Two genuine exclusions in section 6: purely personal or household activity, such as your own contacts list, and information that has been properly de-identified so nobody can be re-identified from it.

We go into this in more detail in the POPIA compliance guide.

The 8 conditions, in plain English

Chapter 3 sets out eight conditions for lawful processing. The legal names are dry, so here is what each actually asks of you.

• Accountability. You must be able to show you are doing the other seven. Being compliant privately is not enough.
• Processing limitation. Have a lawful reason, take only what you need, and get it from the person directly where you reasonably can.
• Purpose specification. Know why you are collecting something before you collect it, and do not keep it once that reason has passed.
• Further processing limitation. If you later want to use it for something else, that new use has to be compatible with the original one.
• Information quality. Make a reasonable effort to keep it accurate and up to date.
• Openness. Tell people what you are collecting and why, and keep a record of your processing.
• Security safeguards. Protect it properly, make your suppliers do the same, and report breaches.
• Data subject participation. Let people see what you hold and correct or delete it.

The full POPIA requirements article maps each condition to its section of the Act.

What rights does POPIA give you?

If you are on the receiving end rather than the business side, section 5 gives you the right to:

• Be told when your information is being collected, and when it has been accessed by someone unauthorised
• Ask an organisation whether it holds information about you, and get a copy
• Have inaccurate information corrected, or unnecessary information deleted
• Object to processing, including for direct marketing
• Not be subject to a decision made purely by an automated system
• Complain to the Information Regulator, and to claim civil damages

Requests generally have to be answered within 30 days.

Consent is not always required

A common misunderstanding is that POPIA means asking permission for everything. It does not. Section 11 gives six lawful grounds, and consent is only one of them. Processing is also lawful when it is necessary for a contract, required by law, protects someone's legitimate interests, is needed for a public duty, or serves the legitimate interests of the business.

Where you do rely on consent, it must be voluntary, specific and informed, and the person can withdraw it at any time. That is why pre-ticked boxes do not work, and why cookie banners without a real reject option fail the test.

Who enforces it, and what happens if you ignore it

The Information Regulator, established under section 39, enforces both POPIA and the Promotion of Access to Information Act. It investigates complaints, issues enforcement notices, and can impose administrative fines.

Penalties reach R10 million or up to 10 years imprisonment for the most serious offences. Separately, under section 99, a person can sue for damages whether or not the Regulator takes action, and they do not have to prove the business intended any harm.

In practice, the first consequence for most businesses is a complaint followed by an enforcement notice, not an immediate fine. Failing to comply with the notice is what escalates it. See POPIA fines and penalties for how each tier works.

How POPIA compares to GDPR

If you already know Europe's GDPR, POPIA will feel familiar. The structure, the lawful grounds and the individual rights all rhyme. The notable differences: POPIA protects companies as well as people, uses "responsible party" and "operator" instead of controller and processor, requires a registered Information Officer, and caps fines in rand rather than as a percentage of global turnover.

The POPIA vs GDPR comparison covers this properly.

If you are here because you have to comply

Most people searching for what POPIA means have been told they need to do something about it. The honest short answer is that compliance has two halves: documents and process.

The documents are the tractable part. A privacy policy, a cookie policy, terms, and a PAIA manual are the baseline for a website. POPIA Ready generates seven of them customised to your business, free to preview before you decide anything.

The process half means appointing and registering an Information Officer, knowing what you hold and why, having contracts with your suppliers, and being able to answer a request or a breach. Our free checklist will score your website in about two minutes and tell you which parts are missing.

This is a plain-English summary of the Act as at July 2026, not legal advice. The Act itself is the authority, and complex situations deserve a professional opinion.