New POPIA Regulations

The Information Regulator has made significant amendments to the Regulations issued under the Protection of Personal Information Act 4 of 2013 which are already in effect.

The changes contained in the new POPIA Regulations are summarised below:

Regulation 1

This makes provision for terminology changes which are not material in terms of compliance.

Regulation 2

Data subjects are provided with more options to enforce their rights with Responsible Parties. An amended Form 1 available from the Information Regulator’s website should be used by data subjects to exercise their rights.

Regulation 3

Responsible Parties now have 30 days to inform data subjects of the action taken regarding requests for the correction or deletion of their personal information. Form 2 or a similar form should be used for raising requests for personal information to be corrected or deleted by the Responsible Party.

Regulation 4

Information Officers are now required to continually improve the POPIA and PAIA Compliance Frameworks for their organsiations, as opposed to monitoring and maintaining them as required by the previous regulations.

Regulation 5

The definition of “private or public bodies” has been replaced with “relevant body/bodies”.

Regulation 6

Changes to obtaining consent for electronic direct marketing have been changed to include telephonic consent which must be recorded electronically. The opt-in and opt-out consent provision has now been removed.  Form 4 available from the Information Regulator’s website should be used to obtain consent for electronic direct marketing.

Regulation 7

A data subject, or a person acting on their behalf, whose personal information has been interfered with may, submit a complaint to the Information Regulator using Form 5 available from the Information Regulator’s website, either the online form or the offline form, should be used submit a complaint.

Administrative Fines

A Responsible Party served with an infringement notice who is unable to pay the administrative fine in a lump sum, may make arrangements with the Regulator to pay the administrative fine in installments.

Link to Forms on the Information Regulator’s website

New POPIA Regulations Download Link.

Prepared by John Cato

IACT-Africa

27 May 2025

Please Contact Us for more information.