Comply with South Africa's POPIA

What is POPIA?

The Protection of Personal Information Act (POPIA) is South Africa's data protection law. It came into full force on July 1, 2021 and is enforced by the Information Regulator. POPIA governs how "responsible parties" (the equivalent of controllers) process personal information, and it is built on eight conditions for lawful processing: accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards, and data-subject participation.

Roles, rights, and breaches

Organizations must designate and register an information officer with the Information Regulator, maintain appropriate security safeguards, and honor data-subject rights such as access, correction, and objection. Where personal information is accessed or acquired by an unauthorized person, the responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible.

Recent developments

In April 2025, the Information Regulator published amendments to the POPIA Regulations that streamlined several processes — including objecting to processing, requesting corrections or deletions, and obtaining consent for direct marketing — strengthening protections for individuals.

How episki helps

episki implements POPIA's eight conditions as living controls, manages information-officer registration and data-subject requests, and provides a breach-notification workflow for the Information Regulator and affected individuals. Because POPIA closely parallels the GDPR — and aligns with LGPD, CCPA, and PIPEDA — your South African privacy program reuses records of processing and rights workflows you already maintain.