South Africa

South Africa data protection & cybersecurity regulation

South Africa's Protection of Personal Information Act (POPIA) is enforced by the Information Regulator, which requires breach notification 'as soon as reasonably possible' (no fixed hour deadline, unlike GDPR) and can impose administrative fines of up to R10 million, as demonstrated by its first-ever fine, R5 million against the Department of Justice in 2023.

Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.

Applicable laws

Protection of Personal Information Act 4 of 2013(POPIA)

South Africa's comprehensive personal information protection statute. Most substantive provisions came into full force on 1 July 2021 following a one-year grace period for compliance. Regulates processing of personal information by public and private bodies.

Source

Breach notification

No fixed statutory hour limit

Section 22 of POPIA does not use a fixed hour deadline like GDPR's 72 hours. Section 22(2) requires notification 'as soon as reasonably possible after the discovery of the compromise, taking into account the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of the responsible party's information system.' Unlike GDPR, POPIA has no risk-based severity threshold, all security compromises must be reported, to both the Regulator and affected data subjects.

Notify: Information Regulator (South Africa)

Source

Statutory maximum fines

Published legal maximums, not a personalized estimate, not legal advice.

POPIA administrative fine (infringement notice, section 109(2)(c))

Up to R10,000,000

POPIA enforcement operates as a ladder, not a direct penalty: the Regulator typically first issues an enforcement notice ordering corrective action with no fine attached; a monetary infringement notice (capped at R10m) is generally issued only if that enforcement notice is ignored. The Information Regulator's first-ever administrative fine (R5 million, July 2023, against the Department of Justice and Constitutional Development following a 2021 ransomware attack) was below the statutory cap.

Source

POPIA criminal offences (section 107)

Up to R10,000,000 and/or up to 10 years imprisonment (most serious offences); up to 12 months for lesser offences

Distinct from the administrative fine track. Criminal prosecution applies only to specific listed offences (e.g. obstructing the Regulator, unlawful acts regarding account numbers, failing to comply with an enforcement notice), not to ordinary data-handling non-compliance generally.

Source

NIS2 status

Not applicable , as of 2026-09-08

Primary authority

Information Regulator (South Africa)(IR)

Visit authority site

Working in South Africa?

See our regional security services

Tools

Frequently asked

Does POPIA require breach notification within 72 hours like GDPR?

No. POPIA has no fixed hour deadline. Section 22(2) requires notification 'as soon as reasonably possible' after discovering a security compromise. Unlike GDPR's risk-based threshold, POPIA has no minimum severity threshold, all security compromises must be reported, however minor they may seem.

Has anyone actually been fined under POPIA, and how much?

Yes. The Information Regulator issued its first-ever administrative fine, R5 million, against South Africa's own Department of Justice and Constitutional Development in July 2023, after the department failed to demonstrate compliance with an earlier enforcement notice following a 2021 ransomware attack. This was below the statutory R10 million cap.

What is the maximum penalty for non-compliance with POPIA?

Administrative fines are capped at R10 million. Separately, section 107 provides for criminal prosecution, up to R10 million and/or up to 10 years' imprisonment, but only for specific listed offences such as obstructing the Regulator, not for general data-handling non-compliance.