What POPIA is and why it applies to you

The Protection of Personal Information Act 4 of 2013 (POPIA) is South Africa's privacy law. It gives people control over how their information is used and requires every organisation that handles it to do so lawfully and securely. It has been fully enforceable since July 2021, and the Information Regulator enforces it.

Why it's your business, not just the company's

POPIA makes the organisation (the "responsible party") accountable. But organisations act through people. When you email a client list, file a CV or chat to a customer, you are processing personal information on your employer's behalf — and your mistakes become the company's breach.

Breaches are rising

The Information Regulator received 2,374 security compromise notifications in the 2024/25 year, and reports in the first part of 2025/26 were running about 40% higher. (The Citizen)

It's not just about hackers

One of the Regulator's recent cases started with a single email. In 2022 an official at the Central Johannesburg TVET College accidentally attached staff vetting reports — including qualifications and criminal record checks — to an email sent to people who shouldn't have seen them. The Regulator ruled that even an accidental internal disclosure is a security compromise, and ordered the college to notify and apologise to the affected staff, discipline the employee, put a compliance framework in place, and train all staff within 90 days with attendance registers as proof. When it missed those deadlines, it was fined R500,000. (Michalsons, Werksmans)

This course, and the certificate you receive at the end, is part of how your employer shows it has trained its people.

Key words

Term	Meaning
Personal information	Information about an identifiable living person — or an existing company.
Data subject	The person (or company) the information is about.
Responsible party	The organisation that decides why and how information is processed — usually your employer.
Operator	An outside service provider that processes information for the responsible party (e.g. a payroll bureau or cloud provider).
Processing	Almost anything you do with information: collect, store, use, send, share, change, delete.
Information Officer	The person in your organisation responsible for POPIA compliance (by default the CEO or head).