Introduction
Many businesses treated POPIA compliance as a project that ended once they had a privacy policy in place. In reality, POPIA compliance is an ongoing responsibility. As your business changes, technology evolves, or new regulatory guidance is issued, your privacy practices need to keep up.
The Protection of Personal Information Act (POPIA) applies to most organisations that collect, store, use, or share personal information. This includes information about employees, customers, suppliers, service providers, and marketing contacts.
Having a POPIA policy on file is a good start, but it is not enough on its own. Businesses need to make sure that their policies are being followed in practice, that information remains secure, and that processes are regularly reviewed and improved.
What’s Changed in Recent Years?
1. Stronger Focus on Data Breach Reporting
In 2022, the Information Regulator published guidance on how organisations should report data breaches or security incidents. If there are reasonable grounds to believe that personal information has been accessed by someone who should not have access to it, the business may need to notify both the Information. Regulator and the affected individuals as soon as reasonably possible.
Importantly, this is not limited to major cyberattacks. Examples might include:
- A staff member’s email account being compromised.
- A laptop, cellphone, or memory device being lost or stolen.
- Personal information being sent to the wrong person.
- Unauthorised access to company systems or records.
Businesses should have a clear incident-response process in place so they know what to do if something goes wrong.
2. New Guidance on Direct Marketing
In December 2024, the Information Regulator issued guidance on direct marketing under POPIA. The key message is simple: you cannot assume you have permission to market to someone electronically.
In most cases:
- Electronic marketing (such as email, SMS, or WhatsApp campaigns) requires consent.
- Existing customers may be contacted under limited circumstances.
- A purchased marketing list does not automatically give you the right to send marketing messages.
- A person’s email address being publicly available does not automatically mean they have consented to marketing.
- Every marketing message must clearly identify the sender and explain how the recipient can opt out of future communications.
- Keeping proper records of consent and opt-out requests is therefore essential.
3. Updated POPIA Regulations (2025)
The POPIA Regulations were updated in April 2025. Some of the most important practical changes include:
- Easier Requests for Individuals
People can now submit requests and complaints through accessible channels, including electronic and telephone channels. If requests are made telephonically, the call must be recorded, and a recording or transcript must be available if requested. - 30-Day Response Requirement
If someone asks for their personal information to be corrected or deleted, the organisation must inform them of the outcome within 30 days. - Stricter Rules for Marketing Consent
Where consent is required for direct marketing: Consent must be obtained through an accessible process. Telephone or automated consent processes must be electronically recorded. Silence or non-response does not count as consent. An opt-out cannot be treated as consent. - Continuous Improvement Required
Information Officers are now specifically required to ensure that the organisation’s POPIA compliance framework is continuously reviewed and improved. - Expanded Complaints Process
The Regulations have expanded the complaints process and introduced provisions that may allow administrative fines to be paid in instalments in appropriate circumstances.
POPIA compliance is not a once-off exercise, a box-ticking exercise, or a document sitting in a filing cabinet. It is an ongoing business responsibility that requires regular attention, practical processes, and evidence that those processes are actually working.
Recent regulatory developments place greater emphasis on accountability, responsiveness, proper record-keeping, and continuous improvement. Organisations that review their practices regularly are generally in a much stronger position to manage risk, respond to incidents, and demonstrate compliance when required.
FHBC can assist clients to review information flows, responsibilities, recordkeeping, marketing practices, operator arrangements and incident-response readiness, and to prioritise proportionate corrective action. Specialist legal or cybersecurity input should be obtained where the circumstances require it.
Contact Adv Lorraine Oosthuysen at lorraine@fhbc.co.za or visit www.fhbc.co.za to discuss a practical review of your organisation’s POPIA Compliance processes.
This article provides general information and is not a substitute for advice on a specific matter.
Source Reference:
- Protection of Personal Information Act, 2013 (Act 4 of 2013):
- Amendment of the Regulations Relating to the Protection of Personal Information, 2018. Government Notice 6126, Government Gazette 52523, 17 April 2025. Available at: https://www.justice.gov.za/legislation/notices/2025/20250417-gg52523gon6126-POPIA-Regulations-Amendment.pdf
- Information Regulator (South Africa). 2024. Guidance Note on Direct Marketing in terms of the Protection of Personal Information Act 4 of 2013 (POPIA), 3 December 2024. Available at: https://inforegulator.org.za/guidance-notes/
- Information Regulator (South Africa). 2025a. Regulations Relating to the Protection of Personal Information, 2021, as amended. Available at: https://www.inforegulator.org.za/wp-content/uploads/2025/04/POPIA-2021-Regulations-FINAL-21-Jan-2025.pdf
- Republic of South Africa. 2013. Protection of Personal Information Act 4 of 2013. Government Gazette 37067, 26 November 2013. Available at: https://www.gov.za/documents/protection-personal-information-act
- Republic of South Africa. 2018. Regulations Relating to the Protection of Personal Information, 2018. Government Notice R1383, Government Gazette 42110, 14 December 2018. Available at: https://www.gov.za/documents/notices/protection-personal-information-act-regulations-information-register-english