POPIA has been enforceable since July 2021 and is enforced by the Information Regulator, which has issued fines and enforcement notices, including against public bodies.
South Africa is strict on direct marketing: electronic marketing requires opt-in consent unless the person is an existing customer. Every business must also maintain a PAIA manual describing how people can request access to records.
- Core data law
- Protection of Personal Information Act 2013 (POPIA)
- Regulator
- Information Regulator
- In force
- 1 Jul 2021
- Information officer
- Must be registered with the Regulator
- Breach notice
- As soon as reasonably possible
- Penalties
- Administrative fines up to ZAR 10 million; criminal offences
Who needs to comply
Businesses processing personal information in South Africa
POPIA applies to processing by responsible parties domiciled in South Africa or using means in South Africa.
Any business marketing electronically to South Africans
Section 69 requires opt-in consent for electronic direct marketing to non-customers.
The laws, in detail
01Protection of Personal Information Act (POPIA)
Eight conditions for lawful processing, information officers, breach notification and transfers.
When it applies
Responsible parties domiciled in South Africa or using automated or non-automated means there.
What you must do
- Register the information officer
- Notify the Regulator and data subjects of security compromises
- Opt-in for electronic direct marketing
- Prior authorisation for some processing
- Transfer conditions for cross-border flows
Regulator
Information Regulator
Penalties
Administrative fines up to ZAR 10 million and imprisonment for certain offences.
02Promotion of Access to Information Act (PAIA)
Access to records held by private and public bodies.
When it applies
Private bodies in South Africa.
What you must do
- Publish a PAIA manual
- Respond to access requests within statutory timelines
Regulator
Information Regulator
Penalties
Enforcement notices and offences.
03Cybercrimes Act 2020
Cybercrime offences and reporting duties.
When it applies
Electronic communications service providers and financial institutions.
What you must do
- Report specified cybercrime offences to SAPS within 72 hours
- Preserve evidence
Regulator
South African Police Service
Penalties
Fines for failure to report.
04Electronic Communications and Transactions Act (ECTA) & Consumer Protection Act
Online sales disclosures, cooling-off, direct marketing opt-outs and unfair terms.
When it applies
Businesses selling to consumers in South Africa online.
What you must do
- Disclose prescribed information on websites
- 7-day cooling-off for online purchases
- Honour direct marketing opt-outs
Regulator
National Consumer Commission
Penalties
Fines and orders.
05FSCA crypto-asset regulation
Crypto assets declared financial products; CASPs need FSP licences.
When it applies
Crypto-asset service providers serving South Africa.
What you must do
- FAIS licence as a financial services provider
- Conduct, disclosure and AML/CFT rules
- Travel Rule compliance
Regulator
Financial Sector Conduct Authority
Penalties
Licence action and penalties.
Compliance checklist
01 · Before you launch
- Register the information officer
- Publish a PAIA manual
- Opt-in marketing consent flows
02 · At launch
- Security compromise notification process
- Operator agreements with vendors
03 · As you scale
- Prior authorisation checks for special processing
- Cross-border transfer review
Key dates
- 1 Jul 2021POPIA enforceable
- 2021Cybercrimes Act partly in force
Common mistakes
- Cold email marketing
- No PAIA manual
- Unregistered information officer
FAQs
Can we send marketing emails in South Africa?
Only with opt-in consent, unless the recipient is an existing customer and other conditions are met.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.