Data protection
The Protection of Personal Information Act has been fully in force since July 2021 and is enforced by the Information Regulator.
Protection rests on the Protection of Personal Information Act (POPIA), fully in force since July 2021 and enforced by the Information Regulator. POPIA is unusual in also protecting the personal information of companies, and the Regulator handles both privacy and access-to-information complaints.
Key points
| Rights | Access, correction, objection, and erasure under the more recent statutes |
|---|---|
| Registration | Data controllers must often register with the regulator |
| Breach notification | Required under most of these Acts |
| Cross-border transfers | Permitted subject to adequacy or safeguards |
| Regulator | Information Regulator of South Africa |
| Sectoral rules | Telecommunications and financial regulators impose additional confidentiality duties |
| Direct marketing opt-in | Electronic direct marketing requires prior consent |
| Information officer | Every organisation must register one with the Regulator |
| Enforcement notices | Failure to comply is an offence with substantial penalties |
| PAIA | Access to information is administered by the same Regulator |
In practice
- Complain first to the organisation's information officer, then to the Regulator.
- Use PAIA where the problem is obtaining records rather than stopping processing.
Where to go
- Information Regulator of South Africa — complaints and guidance.
Worth knowing
South Africa requires opt-in consent for electronic direct marketing, which is stricter than many regimes. Unsolicited messages are usually unlawful from the first one.
The general article: Data protection · Compare with another country
Privacy
Section 14 of the Constitution guarantees privacy. The Protection of Personal Information Act came fully into force in July 2021 and is enforced by the Information Regulator. Independently, the common law actio iniuriarum allows damages for an invasion of privacy as an injury to dignity.
Key points
| Constitution | Section 14, with horizontal application under section 8(2) |
|---|---|
| Statute | POPIA, fully in force since July 2021 |
| Regulator | Information Regulator, which also handles access to information |
| Common law | Actio iniuriarum for injury to dignity and privacy |
| Direct marketing | Opt-in consent required for electronic direct marketing |
| Breach notification | Mandatory to the Regulator and to data subjects |
| Horizontal application | The constitutional right applies between private parties where appropriate |
| Interdicts | Available urgently to restrain publication |
| Information Regulator | Can issue enforcement notices; non-compliance is an offence |
In practice
- Apply for an urgent interdict where publication is imminent: the courts hear such matters quickly.
Where to go
- Information Regulator of South Africa.
- Legal Aid South Africa.
- University law clinics.
Worth knowing
POPIA and the common law give parallel remedies: POPIA for regulatory enforcement, the actio iniuriarum for damages. They can be pursued together. Enforcement notices from the Regulator are binding, and ignoring one is a criminal offence. That gives the complaint route real weight.
Image rights
Section 16 of the Cybercrimes Act 2020 makes it an offence to disclose a data message containing an intimate image of a person without their consent. The Films and Publications Amendment Act 2019 added a parallel offence and empowered the regulator to order take-down. POPIA applies where an identifiable image is processed.
Key points
| Cybercrimes Act 2020 | Section 16: disclosure of an intimate image without consent |
|---|---|
| Films and Publications Act | Parallel offence, with take-down powers for the Board |
| Protection orders | Protection from Harassment Act, obtainable at a magistrate's court |
| Identity of the poster | Courts can direct service providers to disclose it |
| POPIA | Applies to identifiable images |
| Common law | Actio iniuriarum for damages |
| Disclosure orders | Courts can direct service providers to identify an anonymous poster |
| Film and Publication Board | Can order takedown administratively |
In practice
- Apply for a harassment protection order: it is free and can prohibit further sharing.
Where to go
- South African Police Service, nearest station.
- Film and Publication Board online complaints.
- Legal Aid South Africa.
Worth knowing
A harassment protection order can be obtained at a magistrate's court without a lawyer and without a fee, and the court can order the service provider to identify an anonymous poster. The combination of a free protection order and a disclosure direction is unusually effective, and neither requires a lawyer.
The general article: Image rights · Compare with another country
Speech and online harassment
Expression is constitutionally protected except incitement and advocacy of hatred, and the Cybercrimes Act 2020 forms part of the framework.
The framework rests on the constitutional protection of expression, which excludes incitement and advocacy of hatred, together with the Films and Publications Amendment Act on non-consensual intimate images and the Cybercrimes Act 2020. The Protection from Harassment Act provides accessible protection orders, including against anonymous harassers, with courts able to compel service providers to identify them.
Key points
| Actio iniuriarum | Protects dignity and reputation; damages for injury to feelings |
|---|---|
| Harassment Act | Protection orders from a magistrate's court, free of charge |
| Identity disclosure | The court can order a service provider to identify an anonymous poster |
| Cybercrimes Act | Criminalises threatening and harmful data messages |
In practice
- Apply for a harassment protection order at the magistrate's court: it is free and quick.
- Ask the court to direct the platform to disclose the poster's identity.
Where to go
- Magistrates' courts for harassment protection orders.
- Film and Publication Board for intimate image takedowns.
- South African Human Rights Commission for hate speech complaints.
Worth knowing
The power to order identification of an anonymous poster is the most useful feature of the Harassment Act, and it is available without a lawyer.
The general article: Speech and online harassment · Compare with another country
Copyright
The Copyright Act 1978 protects works for the author's life plus fifty years and provides narrow fair dealing exceptions. A Copyright Amendment Bill proposing a fair use clause, exceptions for education and people with disabilities, and resale royalties for artists has been through an unusually long legislative process, including referral back to Parliament on constitutional grounds, and is not in force.
Key points
| Statute | Copyright Act 1978 |
|---|---|
| Term | Life plus 50 years for most works |
| Fair dealing | Narrow: research, private study, criticism, review, reporting |
| No registration | Except for cinematograph films, which have a registration system |
| Amendment Bill | Long-running reform proposing fair use; not in force |
| Enforcement | High Court, and the Companies and Intellectual Property Commission for films |
| Film registration | Cinematograph films have their own registration system |
| Needletime | Performers' rights in sound recordings generate separate royalties |
| Copyright Tribunal | Hears disputes over licensing terms |
In practice
- Register films with CIPC: it is the only registration system available.
Where to go
- Companies and Intellectual Property Commission.
- DALRO, SAMRO and other societies.
- Copyright Tribunal for licensing disputes.
Worth knowing
Do not rely on the Amendment Bill: its provisions have been widely reported as if already law, but the 1978 Act and its narrow exceptions continue to apply. Do not rely on the Amendment Bill. Its fair use clause has been widely reported as law, but the 1978 Act and its narrow exceptions still apply.
The general article: Copyright · Compare with another country
Identity theft
The Cybercrimes Act covers the theft of incorporeal property, and SAFPS protective registration is free.
The Cybercrimes Act 2020 created offences of unlawful access, unlawful acquisition of data and cyber fraud. The Southern African Fraud Prevention Service offers free Protective Registration, which flags your identity so that credit providers apply additional verification. Credit bureaus must provide a free annual credit report.
Key points
| Statute | Cybercrimes Act 2020, plus common law fraud |
|---|---|
| Protective registration | Free with the Southern African Fraud Prevention Service |
| Credit reports | One free report a year from each registered bureau |
| Regulator | National Credit Regulator for disputes with credit providers |
| Data breach | Notify the Information Regulator under POPIA |
| Documents | Report a lost ID to Home Affairs and to SAPS |
In practice
- Register free with SAFPS for protective registration.
- Obtain your free credit reports and dispute every unknown account with the bureau, which must investigate.
- Open a case with SAPS and keep the case number.
- Report a lost or stolen identity document to Home Affairs.
Where to go
- Southern African Fraud Prevention Service.
- National Credit Regulator.
- Information Regulator.
Worth knowing
A bureau must investigate a disputed entry within a set period and remove it if it cannot be substantiated: dispute in writing, not by phone.
The general article: Identity theft · Compare with another country
Online shopping
A seven-day cooling-off right for electronic transactions and a six-month right to return defective goods.
The Electronic Communications and Transactions Act gives consumers seven days to cancel most online purchases without reason. The Consumer Protection Act adds a general right to return unsafe or defective goods within six months for a repair, replacement or refund, at the consumer's choice.
Key points
| Cooling-off | Seven days for most electronic transactions, no reason required |
|---|---|
| Six-month right | Return defective goods for repair, replacement or refund, chosen by the consumer |
| Direct marketing | Five business days to cancel goods bought through direct marketing |
| Unfair terms | Prohibited, with a plain-language requirement |
| Fixed-term contracts | Maximum durations and cancellation rights apply |
| Regulator | National Consumer Commission and the Consumer Goods and Services Ombud |
| Consumer Protection Act 2008 | Includes a five-business-day cooling-off right for direct marketing |
| Six-month right of return | Goods that are defective may be returned within six months for repair, replacement or refund |
| Consumer's choice | The consumer, not the supplier, chooses between repair, replacement and refund |
| National Consumer Commission | Handles complaints and refers to the Tribunal |
In practice
- State that you choose a refund or replacement: the Act gives the choice to you.
- Escalate to the National Consumer Commission or an accredited ombud scheme.
Cost and coverage
Complaints to the Ombud and the Commission are free.
Recent changes
The six-month right, where the consumer rather than the supplier chooses the remedy, is unusually strong by international standards.
Where to go
- Consumer Goods and Services Ombud.
- National Consumer Commission.
- Provincial consumer affairs offices.
Worth knowing
Under the Consumer Protection Act, you choose between repair, replacement and refund within six months — not the retailer. Say so explicitly when making the claim. The six-month return right is one of the strongest in the world, and the choice of remedy belongs to the consumer. Traders frequently claim otherwise.
The general article: Online shopping · Compare with another country
Romance scams
Police reporting, a fraud prevention service that protects your identity, and a banking ombudsman.
A case is opened at any police station, with commercial crime units handling larger matters. A fraud prevention service allows a victim to register a protective listing so that lenders apply extra checks before granting credit in their name. The banking ombudsman resolves disputes with banks free of charge.
Where to go
- Any police station, for the criminal case
- Fraud prevention service, for protective registration against identity fraud
- Ombudsman for banking services, free of charge
Sources
- South African Police Service — open a case at any station
- Southern African Fraud Prevention Service — free protective registration against identity fraud
- National Financial Ombud Scheme — free resolution of banking disputes
The general article: Romance scams · Compare with another country
General sources
- gov.za — official government portal
- South African Human Rights Commission — constitutional rights body