CevroSouth Africa: POPIA and what it requires
Protection of Personal Information Act (POPIA) 2013: an established law with an active enforcement record. Overseen by Information Regulator (South Africa).
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Administrative fines and, for serious offences, possible imprisonment.
What to know in practice
In force since 2021 with eight conditions for lawful processing; one of Africa's strongest enforcement track records.
The security duty
Under s.19: Security measures: appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction and unlawful access or processing. Source: published text, checked 2026-10.
How Cevro helps
- Maps POPIA to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Counts your automated technical checks as evidence toward the security duty in s.19.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in South Africa?
Information Regulator (South Africa) oversees Protection of Personal Information Act (POPIA) 2013.
Is breach notification mandatory under POPIA?
Our reference does not record a fixed hourly deadline for POPIA. Check the statute and Information Regulator (South Africa) guidance for the notification timing that applies to you.
Does South Africa restrict cross-border data transfers?
Yes. Moving personal data out of South Africa is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under POPIA?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in South Africa?
Administrative fines and, for serious offences, possible imprisonment.