Protection of Personal Information Act 4 of 2013 (POPIA) compliance software
South Africa's data protection law with its 2018 Regulations as amended on 17 April 2025: 93 controls across 14 domains, from the Information Officer and the eight conditions for lawful processing to section 22 security compromise notices and an Assurance domain.
- RegulatorInformation Regulator (South Africa)
- InstrumentPOPIA, Act 4 of 2013; POPIA Regulations 2018, as amended 17 April 2025
- Structure14 domains · 93 controls, 11 of them in the Assurance domain
- NotificationsSecurity compromises as soon as reasonably possible, through the eServices portal · fines up to R10 million
What POPIA requires
Who it applies to
- Every public and private body that processes personal information in South Africa, including a body domiciled elsewhere that uses means in the Republic to process it
- Operators processing personal information for a responsible party under a contract or mandate, who must keep it confidential and report a suspected compromise to the responsible party immediately
- Information Officers and deputy Information Officers, who may take up their duties only after the responsible party has registered them with the Regulator
- Organisations marketing by electronic communication, which need the person's prior consent unless they are an existing customer, under section 69
The Protection of Personal Information Act 4 of 2013 is South Africa's general data protection law, enforced by the Information Regulator. Most of it commenced on 1 July 2020 with a one-year grace period that ended on 30 June 2021. The Regulations relating to the Protection of Personal Information, 2018, were amended with immediate effect on 17 April 2025: regulation 4 now requires the Information Officer's compliance framework to be developed, implemented, monitored, maintained and continually improved, and its PAIA manual paragraphs were deleted, leaving that duty to PAIA itself. GRCLens carries 93 assessable controls across 14 domains, quoted from the Act and the amended Regulations.
Thirteen domains follow the Act: the eight conditions for lawful processing, from accountability and the Information Officer to data subject participation, with security safeguards and operators (sections 19 to 21); security compromise notification (section 22); special personal information and children (sections 26 to 35); prior authorisation (sections 57 and 58); direct marketing, directories and automated decisions (sections 69 to 71); and transborder flows (section 72). The fourteenth, Assurance, holds 11 controls for verifying and updating safeguards, monitoring and improving the compliance framework, the personal information impact assessment, internal audit, operator assurance and readiness for an assessment by the Regulator under section 89. Controls derived from a duty rather than stated in it are labelled as derived.
Section 22 sets no fixed deadline: the Regulator and affected data subjects must be told as soon as reasonably possible after a compromise is discovered, and since 1 April 2025 notifications must be made through the Regulator's eServices portal rather than by email. The Regulator can impose an administrative fine of up to R10 million. Its first, R5 million against the Department of Justice and Constitutional Development in July 2023, followed a ransomware attack on systems whose security licences had lapsed. A second R5 million fine, against the Department of Basic Education, was set aside by the High Court in December 2025, and the Regulator is pursuing an appeal.
How GRCLens supports POPIA
POPIA runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Section 22 as a tracked clock
Discovery, the notice to the Regulator through the eServices portal, written notice to data subjects and the reasons for any delay are separate controls, so the record shows what was decided and when, not only that a form was filed.
Every control quotes its source
Each of the 93 controls carries the section or regulation it comes from, practical guidance and the deliverables an assessor expects, such as the Information Officer's registration or the personal information impact assessment.
Assurance as its own domain
Eleven controls cover verifying and updating safeguards under section 19(2), monitoring and continually improving the compliance framework under amended regulation 4, internal audit and readiness for a section 89 assessment, so the programme shows it is checked, not only that it exists.
Operators in scope
Sections 20 and 21 are assessed against each operator that holds personal information, with the written contract, the security measures it requires and the operator's duty to report compromises as evidence.
Shared evidence with ISO/IEC 27001 and Joint Standard 2
Section 19 safeguards sit on the same control model as ISO/IEC 27001 and Joint Standard 2 of 2024, so a South African bank or insurer evidences an access control or an incident procedure once for all three.
POPIA frequently asked questions
Does POPIA have a 72-hour deadline for reporting a breach?
No. Section 22 requires the Information Regulator and affected data subjects to be notified as soon as reasonably possible after the compromise is discovered, allowing for the needs of law enforcement and the steps needed to establish its scope and restore the integrity of the system. The notification should explain any delay.
How is a security compromise reported to the Information Regulator?
Through the Security Compromises Reporting feature of the Regulator's eServices portal. Use of the portal has been mandatory since 1 April 2025, replacing submission of Form SCN1 by email.
What changed in the POPIA Regulations in April 2025?
The amendment published on 17 April 2025 took effect immediately. Regulation 4 now requires the compliance framework to be monitored and continually improved, the PAIA manual paragraphs were deleted, objections and correction requests can be made free of charge through channels including email, SMS and WhatsApp, and direct marketing consent must be given on a form substantially similar to Form 4, with opting out no longer treated as consent.
What is the maximum fine under POPIA?
An administrative fine of up to R10 million under section 109. Some offences, including failing to comply with an enforcement notice, carry up to 10 years' imprisonment under section 107.
Does an Information Officer have to be registered?
Yes. Every public and private body has an Information Officer by default, the chief executive or equivalent in a private body, and section 55(2) says Information Officers may take up their duties only after the responsible party has registered them with the Regulator.
One platform, many obligations
See all supported frameworks → Every framework that applies in South Africa →
Talk to us about POPIA
Security Solution Consultants provides POPIA and data protection advisory in South Africa alongside the platform, so you can combine tooling with hands-on expertise.