POPI Act

Introduction

The Protection of Personal Information Act (PoPIA) is a South African law enacted in 2013. The purpose of PoPIA is to protect the privacy and personal information of individuals and legal entities by regulating the collection, processing, storage, and dissemination of personal information. The PoPIA sets conditions for how institutions can process information and holds them accountable if they abuse or compromise an entity's personal information. The PoPIA applies to both public and private institutions and covers any identifiable, living, natural person or existing juristic person. Personal information includes sensitive data, such as race, gender, sex, pregnancy, marital status, national origin, physical or mental health, biometric information, religious or philosophical beliefs, and personal opinions. The PoPIA gives individuals the right to control their personal information and how it is used, accessed, and shared. The law also establishes an Information Protection Regulator to oversee compliance and enforce penalties for non-compliance.