Page traduite et vérifiée automatiquement. La version anglaise fait foi. Certaines parties restent en anglais le temps que leur traduction soit vérifiée. Voir en anglais · Signaler une erreur de traduction
Réglementations › Reste du monde › Afrique du Sud
POPIA
Protection of Personal Information Act (Afrique du Sud)
QuandEn vigueur depuis le 1er juillet 2021
Qui en assure l’applicationRégulateur de l’information
À qui elle s’appliqueParties responsables traitant des informations personnelles en Afrique du Sud.
Informer le régulateurNotifier le Régulateur dès que raisonnablement possible après la découverte d’une atteinte à la sécurité
DPO requisChaque organisme public et privé dispose d’un responsable de l’information (le dirigeant par défaut), qui doit être en…
EnregistrementAucun enregistrement général des responsables du traitement
Transferts à l’étrangerTransferts à l’étranger autorisés uniquement en cas de protection adéquate (loi, règles d’entreprise contraignantes ou accord…
Délai de réponse aux demandes30 jours : les demandes d’accès suivent les délais de la PAIA
Amende maximaleAmende administrative jusqu’à R10 millions (environ USD 550,000)
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Portée et base légale
Portée extraterritoriale
1
Applies to responsible parties domiciled in South Africa, or not domiciled but using automated or non-automated means in the Republic.s.3(1)(b) · source ↗
Base légale
1
Six lawful grounds including consent, contract, legal obligation, and legitimate interests of the responsible party or a third party.s.11(1) · source ↗
Consentement
2
Consent must be a voluntary, specific and informed expression of will; electronic direct marketing consent follows a prescribed form.s.1 (definition); s.69(2); Reg. 6 and Form 4 · source ↗
Form 4 requirement from the 2018 Regulations as amended by GN 6126 (2025), seen only in secondary summaries.
Données sensibles
2
Special personal information is prohibited unless consent or a listed exception applies; the Regulator may authorize processing in the public interest.ss.26-27 · source ↗
Consolidated statute text on acts.co.za. Prior authorization also applies under s.57 for some uses.
Enfants
3
Child means under 18. Processing children's information is prohibited unless a s.35 exception applies, such as consent of a competent person.s.1; ss.34-35 · source ↗
s.34-35 text not read in full; prohibition confirmed through s.4(4).
Droits des personnes
Droits
3
Access, correction, deletion, objection (including direct marketing), protection from solely automated decisions, and restriction in limited cases.ss.5, 11(3), 14(6), 23, 24, 71 · source ↗
No portability right. Restriction under s.14(6) is a controller duty in listed cases; counted as a right.
Délai de réponse aux demandes
2
30 days: access requests follow PAIA timelines; amended regulations give 30 days to give feedback on correction or deletion requests.s.23(3) (PAIA procedure); Reg. 3 as amended by GN 6126 (2025) · secondary source · source ↗
PAIA s.56(1) text not fetched (blocked); 30 days is the standard PAIA period.
Marketing
2
Electronic direct marketing requires prior opt-in consent, which may be requested only once; existing customers may receive similar offers with an opt-out.s.69(1)-(3) · source ↗
Gouvernance
DPO requis
3
Every public and private body has an Information Officer (the head by default), who must be registered with the Regulator before taking up duties.s.1; s.55(2); s.56 · source ↗
Qualifications du DPO
2
No legal qualification. Regulator guidance expects executive-level IOs and requires multinationals to authorize an IO and deputies based in South Africa.Guidance Note on Information Officers (2021) · source ↗
Guidance, not binding law. Training recommended, not mandatory.
Enregistrement
1
No general controller registration. Information Officers must be registered; prior authorization needed for listed processing such as credit reporting.s.55(2); ss.57-58 · source ↗
DPIA
3
The Information Officer must ensure a personal information impact assessment is conducted; not limited to high-risk processing.Reg. 4(1)(b), POPIA Regulations 2018 (GN R1383) · secondary source · source ↗
Regulation text not read directly; requirement is broad but its scope and content are not prescribed.
Registres
2
Responsible parties must maintain documentation of all processing operations, as required by PAIA manuals.s.17 · source ↗
Conservation
2
Records may not be kept longer than necessary for the purpose and must be destroyed, deleted or de-identified afterward.s.14(1), (4) · source ↗
s.14(4) destruction duty not quoted in the text read; s.14(1) confirmed.
Violations
Informer le régulateur
1
Notify the Regulator as soon as reasonably possible after discovering a security compromise; no fixed hour limit. Filed through the eServices portal since April 2025.s.22(1)-(2) · source ↗
Information des personnes
3
Notify affected data subjects in every compromise unless their identity cannot be established, as soon as reasonably possible.s.22(1) · source ↗
Transferts
Transferts à l’étranger
2
Transfers abroad allowed only with adequate protection (law, binding corporate rules or agreement), consent, contract necessity, or data subject benefit.s.72(1) · source ↗
Prior Regulator authorization is required for special or children's data sent to countries without adequate protection (s.57(1)(d)).
Application
Responsabilité pénale
2
Listed offenses carry a fine or up to 10 years' imprisonment, others up to 12 months.s.107 · source ↗
Action privée
2
Data subjects, or the Regulator on their behalf, may sue for patrimonial, non-patrimonial and aggravated damages, regardless of intent or negligence.s.99(1), (3) · source ↗
POPIA does not address class actions; they may be possible under general South African law.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Bibliothèque des réglementations
Toutes les lois des États américains sur la vie privée, sur une seule carte
24 États disposent d’une loi générale sur la vie privée dans la bibliothèque, aux côtés des lois de l’UE, du Royaume-Uni, des lois fédérales américaines et des lois du reste du monde : 102 au total, chacune expliquée en termes simples avec ses sources. Sélectionnez un État pour voir ce qui s’y applique.
- En vigueur
- Entrée en vigueur prochaine
- Lois sectorielles