The legal framework
Section 14 of the Constitution guarantees privacy. The Protection of Personal Information Act came fully into force in July 2021 and is enforced by the Information Regulator. Independently, the common law actio iniuriarum allows damages for an invasion of privacy as an injury to dignity.
Key points
| Constitution | Section 14, with horizontal application under section 8(2) |
|---|---|
| Statute | POPIA, fully in force since July 2021 |
| Regulator | Information Regulator, which also handles access to information |
| Common law | Actio iniuriarum for injury to dignity and privacy |
| Direct marketing | Opt-in consent required for electronic direct marketing |
| Breach notification | Mandatory to the Regulator and to data subjects |
| Horizontal application | The constitutional right applies between private parties where appropriate |
| Interdicts | Available urgently to restrain publication |
| Information Regulator | Can issue enforcement notices; non-compliance is an offence |
In practice
- Send a written access request first: it forces the other side to disclose what it holds and creates a paper trail.
- Screenshot everything, with the date and the URL visible, before asking for removal.
- Complain to the regulator — it is free — and keep the reference number.
- Court action is the last step, and the limitation periods are short: take advice early.
- Apply for an urgent interdict where publication is imminent: the courts hear such matters quickly.
Where to go
- Information Regulator of South Africa.
- Legal Aid South Africa.
- University law clinics.
Worth knowing
POPIA and the common law give parallel remedies: POPIA for regulatory enforcement, the actio iniuriarum for damages. They can be pursued together. Enforcement notices from the Regulator are binding, and ignoring one is a criminal offence. That gives the complaint route real weight.
Official sources and links
- gov.za — official government portal
- South African Human Rights Commission — constitutional rights body