🇿🇦Protection of Personal Information Act 4 of 2013
← Back to laws in South Africa
Protection of Personal Information Act 4 of 2013
The official Department of Justice Act, the Information Regulator's current general Regulations and the 2026 health-information Regulations are the source documents used for this operational summary.
Core operational duties
Accountability and lawful processing: Sections 8-17 require the responsible party to satisfy the processing conditions, limit collection and further use to legitimate purposes, maintain data quality and avoid retaining records longer than necessary.
Transparency and rights: Sections 18 and 23-25 require collection notices and workable access, correction, deletion and objection procedures. The Regulations prescribe forms and response mechanics.
Security and incidents: Sections 19-22 require appropriate safeguards, written operator obligations and notification to the Information Regulator and affected data subjects when personal information has been accessed or acquired by an unauthorised person. The 2026 Regulations add physical and electronic record-security, confidentiality and secure-disposal requirements for specified parties processing health information.
Governance and higher-risk processing: Sections 55-58 address Information Officers and prior authorisation. Sections 69, 71 and 72 regulate electronic direct marketing, solely automated decisions and transfers outside South Africa.
POPIA uses the terms “responsible party” and “operator”. Applicability and any prior-authorisation requirement must be assessed against the organisation's actual processing. The 2026 health-information Regulations specifically cover insurers, medical schemes and administrators, managed-care organisations, designated administrative bodies, pension funds, employers and institutions working for them.