South Africa

South Africa's regime is anchored by the Protection of Personal Information Act 4 of 2013 (POPIA), the country's principal data protection statute, assented to on 19 November 2013 and implemented in stages: the provisions establishing the Information Regulator came into force in April 2014, the bulk of the operative compliance provisions on 1 July 2020 (with a one-year transition), and enforcement from 1 July 2021. POPIA applies to any responsible party (the local term for a controller) processing personal information where it is domiciled in South Africa, or, if not, where it uses means in South Africa, excluding purely personal or household processing. POPIA requires compliance with eight conditions for lawful processing, accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data-subject participation, and imposes enhanced requirements on special personal information (health, race or ethnicity, biometrics, political persuasion, religious belief, trade-union membership, criminal behaviour, sexual orientation). Data subjects have rights of access, correction, deletion, and objection, including to electronic direct marketing. Responsible parties must notify both the Regulator and affected data subjects of a security compromise, restrict cross-border transfers to adequate jurisdictions or specified conditions, and appoint and register an Information Officer; penalties reach fines of up to R10 million and ten years' imprisonment. Enforcement rests with the Information Regulator, an independent body accountable to the National Assembly with broad powers over both public and private sectors, enforcement and information notices, investigations, fines, and criminal referrals, which also administers the Promotion of Access to Information Act. POPIA is one of the continent's most influential and well-developed laws; ATLPF currently documents the primary Act and its regulator, supporting a solid single-instrument-plus-regulator coverage position.