South Africa POPIA

Protection of Personal Information Act (POPIA)

South Africa's comprehensive data protection law. Section 71 restricts automated decisions. Film and Publications Amendment Act adds chatroom safety duties.

Jurisdiction

South Africa

Enacted

Nov 19, 2013

Effective

Jul 1, 2021

Enforcement

Information Regulator South Africa

South African Government — Protection of Personal Information Act 4 of 2013, official gazette text PDF

Why It Matters

Largest African economy; Section 71 applies to AI mental health recommendations. Gateway for African market.

Recent Developments

National AI Policy Framework (Oct 2024) signals future AI legislation. Information Regulator increasingly active.

At a Glance

Requires

Transparency User Rights Data Minimization

Who Must Comply

Responsible parties processing personal information in South Africa
Foreign entities processing SA residents' data

Obligations fall on:

Safety Provisions

Section 71: Prohibition on decisions based solely on automated processing with legal/significant effects
Sections 26-33: Special personal information (health, children) requires explicit consent
Section 35: Children's data requires parent/guardian consent
Film and Publications Amendment: Chatroom safety; child protection for digital services
Mandatory breach notification

Compliance & Enforcement

Penalties

ZAR 10M; criminal (up to 10yr)

Criminal liability

Primary Source

South African Government — Protection of Personal Information Act 4 of 2013, official gazette text PDF

https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf

View on map

South Africa

Focus Areas

Mental health & crisis

Child safety

Algorithmic accountability

Active safeguards required

Cite This

APA

South Africa. (2013). Protection of Personal Information Act (POPIA).

Related Regulations

In Effect ZM

Zambia DPA

Zambia's comprehensive data protection law with special protections for vulnerable persons and DPIA requirements for high-risk processing.

In Effect BW

Botswana DPA

Botswana's modernized data protection law requiring Data Protection Impact Assessment and establishing age 16 for consent.

In Effect SC

Seychelles DPA

Seychelles' modern data protection law requiring DPO for large-scale processing and recognizing Cross-Border Privacy Rules certification.

In Effect RW

First African country to adopt comprehensive national AI policy. Establishes Responsible AI Office (RAIO) under MINICT. Implements RURA ethical guidelines covering beneficence, non-maleficence, autonomy, justice, explicability, transparency. Non-binding framework.

Proposed KE

Kenya AI Bill

First comprehensive AI bill in Sub-Saharan Africa. Proposes creation of AI Commissioner, AI Authority, and Advisory Committee. Establishes risk-based regulatory model aligned with EU AI Act framework, criminalizes harmful deepfakes, and mandates AI content labeling.

Enacted US-CA

CA SB 1276

Amends California's sexual-exploitation-of-a-child offence (Penal Code Section 311.3) so that it covers digitally altered or artificial-intelligence-generated matter depicting a person under 18 engaged in sexual conduct, and adds knowingly downloading, streaming or accessing such matter through electronic or digital media to the prohibited conduct. It makes the same extension to the definition of sexual exploitation that triggers mandated reporting under the Child Abuse and Neglect Reporting Act (Section 11165.1).

All regulations See what's likely relevant to your deployment

Last updated September 12, 2026. Verify against primary sources before relying on this information.