South Africa

The Protection of Personal Information Act 4 of 2013, section 3(1)(b), sets the reach. The Act applies where the organisation deciding why data is used is based in the Republic. It also applies where that organisation is not based there but 'makes use of automated or non-automated means in the Republic'. There is an exception where those means are used only to forward personal information through the Republic. The Regulator has been willing to act against very large foreign platforms. It served an enforcement notice on WhatsApp on 16 April 2025 under section 95 of the Act. Every organisation also has an 'information officer'. By default that is the head of the organisation, not a specialist. That person must be registered with the Regulator before taking up those duties (section 55(2)).

Industry by industry, checked on 18 August 2026. TAX RECORDS, ALL COMPANIES. Electronic records kept outside South Africa need prior written authorisation from a senior official of the South African Revenue Service. Rated conditional. BANKS AND FOREIGN-EXCHANGE DEALERS. The central bank's Financial Surveillance Department considers offshoring and cloud use only case by case, on formal application. Moving the business processes themselves offshore, rather than the data, is refused outright. Storage in sanctioned countries is refused. So is storage anywhere that would block regulator access. Rated conditional. BANKS GENERALLY. The Prudential Authority's Directive 3 of 2018 and Guidance Note 5 of 2018 allow cloud use and offshoring, subject to its requirements. The board carries ultimate responsibility. Rated conditional. PAYMENTS. No rule today says where the data must sit. But in March 2025 the central bank proposed keeping clearing and settlement data of payment market infrastructures inside South Africa. Rated open today, closed if the proposal is issued. INSURANCE. No rule says where the data must sit. The joint insurance outsourcing standard requires 30 days' notice to the regulators before a material outsourcing, plus contractual access rights. Rated open. GOVERNMENT. Government data touching national security must be stored only on infrastructure inside South Africa, under the National Data and Cloud Policy. The State Information Technology Agency is the buying channel for government cloud. Rated closed for that category. HEALTH, TELECOM, EDUCATION, GAMBLING, MAPPING. We found no rule on official sources about where data must sit, checked 18 August 2026. Telecoms must keep call and connection records for between three and five years, but the law does not say where.

Section 72 of the Protection of Personal Information Act lists five grounds. An adequate law, binding corporate rules, or a binding agreement covering the recipient and onward transfers. The person's consent. Necessity for their contract. Necessity for a contract made in their interest. Or benefit to them where consent is impractical. There is no official standard contract template. There is no list of approved countries, and no registration step. So 'adequate protection' here is something you decide yourself and must be able to defend. Separately, section 57(1)(d) requires prior authorisation from the Regulator in some cases. That is before sending special personal information, or children's personal information, to a recipient in a country without adequate protection. Special personal information covers race, health, sex life, biometrics, religion, politics, trade union membership and criminal behaviour. Under section 58 you may not start until the Regulator says it will not investigate further, or finishes investigating. It has four weeks for the initial answer, and up to thirteen weeks more. That is a real case-by-case approval layer on top of an otherwise self-service system. Approvals for particular industries from the central bank and the revenue service run in parallel. Section 72 does not replace them.

The Information Regulator (South Africa) was set up under section 39 of the Protection of Personal Information Act. It has been operational since 2016 and took over privacy enforcement on 1 July 2021. Members as at 18 August 2026 are Adv Pansy Tlakula (Chairperson), Adv Lebogang Stroom (full-time) and Mr Mfana Gwala (part-time). One full-time and one part-time seat are shown as vacant on the Regulator's own members page. Enforcement notices published for 2026 follow. Central Johannesburg TVET College on 20 May 2026, for unlawful sharing of special personal information and failure to report a security compromise. Sibanye Stillwater on 2 June 2026, on access to information. Gauteng Department of Health on 10 June 2026. The Blouberg Local Municipality matter shows most clearly how enforcement works. It ran from complaint, to investigation, to enforcement notice, to infringement notice. Then came a court application under section 109(5) to turn the administrative fine into a court order. The Regulator imposed 500,000 rand. The Polokwane High Court reduced it to 250,000 rand in early April 2026, because only one person was affected and it was a first offence. The other enforcers are the Prudential Authority and Financial Sector Conduct Authority for financial institutions. The central bank's Financial Surveillance Department handles exchange control. The South African Revenue Service handles tax records.

The limit is section 14 of the Protection of Personal Information Act. You must not keep records longer than you need them for the purpose. You must destroy, delete or de-identify them as soon as reasonably practicable after that. The destruction must prevent reconstruction. Section 14(1)(a) is the way out. You may keep data where that is 'required or authorised by law'. Now the minimums. Tax records: five years from filing, and longer if a return is outstanding or an audit is running. Records under the Financial Intelligence Centre Act: five years from the end of the business relationship or the transaction. Exchange-control data at authorised dealers: five years, retrievable within 48 hours. When an offshore arrangement ends, the previous five years of data must be copied back to South Africa. Telecommunications connection records: a period fixed by ministerial directive, which may 'not be less than three years and not more than five years'. The sharpest conflict is in the public sector. Under the National Archives and Records Service of South Africa Act, no public record may be destroyed or erased without the National Archivist's written authorisation. So a government body cannot simply honour a deletion request the way a company can.

Section 22 of the Protection of Personal Information Act sets the duty. You must notify the Regulator and each identifiable affected person as soon as reasonably possible after discovery. You may allow for the needs of law enforcement, and for work to determine the scope and restore the system. You may only delay notice if the police or the Regulator say it would impede a criminal investigation. The notice must describe the likely consequences and what you are doing about it. It must say what the person should do. And it must identify the intruder if you know who it is. Since April 2025 you report breaches through the Regulator's online services portal. Section 54 of the Cybercrimes Act 19 of 2020 carries a 72-hour deadline. It would require communications providers and financial institutions to report to the police. It was expressly left out of the commencement proclamation of 30 November 2021 and is still not in force. It also depends on the Minister of Police first listing the categories of offence by notice, which we have not found. For financial institutions, Joint Standard 1 of 2023 on information technology governance took effect on 15 November 2024. Joint Standard 2 of 2024 on cybersecurity and cyber resilience took effect on 1 June 2025. The notification template for material technology and cyber incidents was still out for consultation in September 2025. So the precise deadline is not settled.

(1) The enforcement chain runs in steps. First an investigation. Then an enforcement notice. Then an infringement notice with an administrative fine capped at 10 million rand. Then a court application to make it an order. Failing to comply with an enforcement notice is an offence carrying up to ten years' imprisonment. Courts will reduce fines they consider excessive, as in the Blouberg municipality matter in April 2026. (2) Prior authorisation under sections 57 and 58 covers more than transfers. It also covers linking unique identifiers across organisations, handling information about criminal behaviour for third parties, and credit reporting. You must stop until the Regulator responds. (3) The Regulations were amended with immediate effect on 17 April 2025. They now say plainly that opt-out is not consent for unsolicited electronic marketing. Consent requested by telephone or automated calling machine must be electronically recorded. You must give that recording to the person free of charge on request. (4) Section 17 of the National Health Act creates a criminal offence. You may not connect a computer holding patient records to another computer or terminal without authority. That is a live risk for any health system integration or cloud migration. (5) Tax records in electronic form kept outside South Africa need authorisation from a senior revenue service official. (6) A sixth applies to public bodies. They cannot delete public records without the National Archivist's written authorisation. So honouring a deletion request may itself be unlawful.

Dated items. March 2025: the central bank's payments department proposed a directive under section 12 of the National Payment System Act. It would require prior approval before payment institutions use cloud or offshore data. It would also require clearing and settlement data, systems and infrastructure of payment market infrastructures to sit inside South Africa. Cross-border settlement systems would be excluded. No directive had been issued as at 18 August 2026. May 2025: Joint Communication 2 of 2025 named two bodies, the Financial Sector Conduct Authority and the Prudential Authority. They are developing a cloud computing and data offshoring Joint Standard. It is to be published for consultation. Nothing was published as at 18 August 2026. 26 September 2025: draft regulations on handling health or sex-life data. Comments closed on 10 October 2025 and they are not yet final. 30 April 2026: the Regulator gazetted its own code of conduct on handling personal information at gated accesses. It covers closed-circuit television and biometric access control, and the comment period was extended in May 2026. Once issued, breaching a code of conduct counts as interference with the protection of personal information. POWERS THAT CAN BE USED WITHOUT NEW LEGISLATION. Section 54 of the Cybercrimes Act, the 72-hour police reporting duty, needs only a presidential proclamation plus a ministerial notice listing offence categories. Chapter 9 of the Electronic Communications and Transactions Act lets the Minister declare classes of information to be 'critical data'. The Minister can then set binding rules on storing, archiving, transferring and controlling the databases holding it. We found no such notice as at 18 August 2026. The telecommunications retention period is set by ministerial directive, within a three-to-five-year band. And the 10 million rand fine ceiling can be raised for inflation by ministerial notice.