South Africa: New POPIA regulations issued

On 17 April 2025, the Information Regulator published amended regulations under the Protection of Personal Information Act (“POPIA”). These serve to amend the existing 2018 Regulations.

The amended regulations introduce new clarity, by inserting definitions for key terms such as “complainant”, “complaint”, “day”, “office hours” and “relevant body/bodies”.

Substantively, the regulations strengthen the rights of data subjects to object to the processing of their personal information. Responsible parties must now ensure objections are made free of charge and through accessible channels, including hand delivery, fax, post, email, SMS, WhatsApp “and or in any manner expedient to a data subject in terms of section 11(3)(a) of the Act.” Responsible parties must also inform data subjects of their right to object when collecting their personal data.

Further, the regulations strengthen data subjects’ right to request the correction, destruction or deletion of a record of their personal information at any time and free of charge, if a responsible party is no longer authorised to retain the personal information. The responsible party must provide accessible procedures to enable the data subject to make these requests. The regulations provide that responsible parties are required to notify the data subject in writing of the action taken within 30 days of receipt of the outcome of the request.

Further, the regulations provide clearer guidelines on direct marketing and complaint procedures, including the requirement for responsible parties to get written consent before processing personal information for direct marketing via unsolicited electronic communication. This consent must be obtained through accessible channels, including email, phone calls, SMS, WhatsApp, fax, or automated calling machines. Notably, providing for opt-out procedures does not constitute valid consent under the amended regulations.

The regulations also provide further detail on complaints procedures within the Information Regulator, including that:

• The Regulator must provide assistance in filing complaints, and acknowledge receipt within 14 days;
• Complaints can now be lodged by interested third parties and public interest actors;
• The identity of a complainant will be protected if a complaint includes information which is protected under the Protected Disclosures Act 26 of 2000.

The amended regulations are available here.

Please note: The information contained in this note is for general guidance on matters of interest, and does not constitute legal advice. For any enquiries, please contact us at [email protected].