POPIA: Protection of Personal Information Act (South Africa)
What POPIA covers, and what it means for your website analytics
Official name: Protection of Personal Information Act 4 of 2013 (POPIA). Its main provisions have applied since 1 July 2020, with enforcement from 1 July 2021, and govern how personal data of people in South Africa is processed.
See all privacy lawsAt a glance
South Africa's data protection law
POPIA sets eight conditions for lawful processing, from accountability to security safeguards. Unusually, it protects companies and other organizations as well as individuals.
Who it covers
Organizations based in South Africa, or using means there to process personal data
What it means for websites
You need a lawful reason, and email marketing to non-customers needs opt-in consent
Who enforces it
The Information Regulator
Maximum fines
Fines of up to R10 million, and up to 10 years in prison for the worst offenses
Further reading
Everything you need on this law
POPIA
The official text of South Africa’s Protection of Personal Information Act 4 of 2013.
Read the official textSouth Africa’s Information Regulator
The authority that enforces POPIA, with guidance notes and codes of conduct for businesses.
Visit the regulatorPOPIA and its regulations
The regulations and official notices that sit alongside POPIA, from the Information Regulator.
See the regulationsLegal disclaimer
Helpful guidance, not legal advice
This page explains the law in general terms. Laws change, and how they apply depends on your business, your visitors and how you configure TWIPLA.
Unless another mode is named, statements about compliance refer to Maximum Privacy Mode, our default setting. For advice on your situation, please consult a qualified legal professional.
Questions about how TWIPLA fits this law? Email our team at consentless@twipla.com.
