← Global Privacy Laws Research Library
Protection of Personal Information Act 4 of 2013
Protection of Personal Information Act, 2013: POPIA: South Africa
Prepared by Shubhank Suman · Last reviewed
CURRENT / FULLY IN FORCE SINCE 1 JULY 2021
- Legal character
- National statute
- Region
- Africa
What it covers
POPIA regulates processing by:
- public bodies
- private bodies
- controllers/responsible parties
- operators/processors.
Its central framework consists of eight conditions:
1. Accountability
2. Processing limitation
3. Purpose specification
4. Further processing limitation
5. Information quality
6. Openness
7. Security safeguards
8. Data-subject participation.
Why it matters
POPIA is particularly useful for AI research because it has a dedicated provision concerning automated decisionmaking.
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
VERY HIGH
Section 71 makes POPIA one of the strongest AI/privacy laws among the first 30.
It is particularly relevant to:
- AI recruitment
- credit scoring
- insurance
- behavioural scoring
- location analytics
- AI profiling.
Cybersecurity
VERY HIGH
Security safeguards and breach notification are central conditions.
Applicability
Public/private bodies processing personal information subject to the Act.
Current validity
CURRENT / FULLY IN FORCE.
Read first
Conditions 1–8 → Section 19 → Section 22 → Section 69 → Section 71 → Section 72.
Provisions / sections covered
Sections 8–11
Foundational conditions.
Section 19: Security safeguards
Requires appropriate technical and organisational measures.
Section 22: Security compromises
Provides notification requirements for security compromises.
Sections 23–25
Data-subject access and related rights.
Section 69: Direct marketing
Important for electronic communications and marketing.
Section 71: Automated decisionmaking
Section 71 restricts decisions based solely on automated processing where the decision:
- produces legal consequences; or
- substantially affects the person,
and is intended to create a profile concerning matters such as:
- employment performance
- creditworthiness
- reliability
- location
- health
- preferences
- conduct.
(National Treasury of South Africa)
Section 72: Transborder information flows
Important for transfers outside South Africa.
Subject-matter tags
- Lawful basis
- Consent
- Profiling
- Automated decision-making
- Impact assessment
- Data breach
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Direct marketing
- Employment data
- Transparency
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.