Two significant regulatory developments have expanded operational compliance requirements for South African public and private bodies regarding annual access reporting and physical security gate controls.
Data privacy enforcement in South Africa has entered an aggressive new phase. The Information Regulator has demonstrated its commitment to enforcing POPIA by issuing administrative fines up to R5 Million and launching a mandatory digital reporting portal.
The Information Regulator has issued its definitive Guidance Note on Direct Marketing, officially closing a long-standing loophole relied upon by telemarketing call centres across South Africa.
The Information Regulator has produced a number of media statements in the first half of 2025, which can be found at Media statements
This morning (22nd June 2020) the Presidency announced dates for compliance to POPIA. The dates are as follows:
The Information Regulator published the "Regulations relating to the Protection of Personal Information" in the Government Gazette on 14th December 2018 42110, RG 10897, GoN 1383 (just when we were all going off on holiday.)
Protection of Personal Information (POPI) isn't new in South Africa. The Protection of Personal Information Bill was around in 2009, which meant that the discussion had been going on for years before that. We became used to talking about POPI, and the Information Regulator is now prefering to use the term POPIA, or POPI Act.
Is there a difference?