South Africa

The Protection of Personal Information Act 4 of 2013, section 3(1)(b), applies the Act where the responsible party (the organisation deciding why data is used) is domiciled in the Republic, or is not domiciled there but 'makes use of automated or non-automated means in the Republic, unless those means are used only to forward personal information through the Republic'. In practice the Regulator has been willing to act against very large foreign platforms: it served an enforcement notice on WhatsApp on 16 April 2025 under section 95 of the Act. Every organisation also has an 'information officer' — by default the head of the organisation, not a specialist — who must be registered with the Regulator before taking up those duties (section 55(2)).

Sector by sector, checked on 18 August 2026. TAX RECORDS, ALL COMPANIES: electronic records kept outside South Africa need prior written authorisation from a senior official of the South African Revenue Service — rated conditional. BANKS AND FOREIGN-EXCHANGE DEALERS: the central bank's Financial Surveillance Department considers offshoring and cloud use only case by case on formal application; offshoring the business processes themselves (as opposed to the data) is refused outright, and storage in sanctioned countries or in places that would block regulator access is refused — rated conditional. BANKS GENERALLY: the Prudential Authority's Directive 3 of 2018 and Guidance Note 5 of 2018 permit cloud use and offshoring subject to its requirements, with the board carrying ultimate responsibility — rated conditional. PAYMENTS: no localisation rule in force today, but the central bank proposed in March 2025 that clearing and settlement data of payment market infrastructures be kept inside South Africa — rated open today, closed if the proposal is issued. INSURANCE: no localisation; the joint insurance outsourcing standard requires 30 days' notice to the regulators before a material outsourcing and contractual access rights — rated open. GOVERNMENT: government data touching national security must be stored only on infrastructure inside South Africa under the National Data and Cloud Policy, and the State Information Technology Agency is the buying channel for government cloud — rated closed for that category. HEALTH, TELECOM, EDUCATION, GAMBLING, MAPPING: no data-location rule found on official sources, checked 18 August 2026; telecoms must keep call and connection records for between three and five years but the law does not say where.

Section 72 of the Protection of Personal Information Act lists five grounds: an adequate law, binding corporate rules or a binding agreement covering the recipient and onward transfers; the person's consent; necessity for their contract; necessity for a contract made in their interest; or benefit to them where consent is impractical. There is no official standard contract template, no adequacy list, and no registration step, so 'adequacy' here is a self-assessment the organisation must be able to defend. Separately, section 57(1)(d) requires prior authorisation from the Regulator before transferring special personal information (race, health, sex life, biometrics, religion, politics, trade union membership, criminal behaviour) or children's personal information to a recipient in a country that does not provide adequate protection. Under section 58 the processing may not start until the Regulator says it will not investigate further, or finishes investigating: four weeks for the initial answer and up to thirteen weeks more. That is a genuine case-by-case approval layer sitting on top of an otherwise self-service regime. Sector-specific approvals from the central bank and the revenue service run in parallel and are not replaced by section 72.

The Information Regulator (South Africa) was established under section 39 of the Protection of Personal Information Act and has been operational since 2016, taking over privacy enforcement on 1 July 2021. Members as at 18 August 2026: Adv Pansy Tlakula (Chairperson), Adv Lebogang Stroom (full-time), Mr Mfana Gwala (part-time), with one full-time and one part-time seat shown as vacant on the Regulator's own members page. Enforcement notices published for 2026: Central Johannesburg TVET College (20 May 2026, unlawful sharing of special personal information and failure to report a security compromise), Sibanye Stillwater (2 June 2026, access to information), Gauteng Department of Health (10 June 2026). The Blouberg Local Municipality matter is the clearest picture of how enforcement actually works: complaint, investigation, enforcement notice, infringement notice, then a court application under section 109(5) to turn the administrative fine into a court order. The Regulator imposed 500,000 rand; the Polokwane High Court reduced it to 250,000 rand in early April 2026 because only one person was affected and it was a first offence. The other enforcers are the Prudential Authority and Financial Sector Conduct Authority (financial institutions), the central bank's Financial Surveillance Department (exchange control), and the South African Revenue Service (tax records).

The ceiling is section 14 of the Protection of Personal Information Act: records must not be kept longer than necessary for the purpose, must be destroyed, deleted or de-identified as soon as reasonably practicable after that, and the destruction must prevent reconstruction. Section 14(1)(a) is the escape hatch — retention is allowed where 'required or authorised by law'. The floors: tax records five years from filing (longer if a return is outstanding or an audit is running); records under the Financial Intelligence Centre Act five years from the end of the business relationship or the transaction; exchange-control data at authorised dealers five years, retrievable within 48 hours, and on termination of an offshore arrangement the previous five years of data must be replicated back to South Africa; telecommunications connection records for a period fixed by ministerial directive that may 'not be less than three years and not more than five years'. The sharpest conflict is in the public sector: under the National Archives and Records Service of South Africa Act no public record may be destroyed or erased without the written authorisation of the National Archivist, so a government body cannot simply honour a deletion request the way a company can.

Section 22 of the Protection of Personal Information Act requires notification to the Regulator and to each identifiable affected person as soon as reasonably possible after discovery, allowing only for the needs of law enforcement and for work to determine the scope and restore the system. Notification may be delayed only if the police or the Regulator say it would impede a criminal investigation. The notice must describe likely consequences, what you are doing about it, what the person should do, and the identity of the intruder if known. Since April 2025 breaches are reported through the Regulator's online services portal. The 72-hour clock in section 54 of the Cybercrimes Act 19 of 2020 — which would oblige communications providers and financial institutions to report to the police — was expressly excluded from the commencement proclamation of 30 November 2021 and remains uncommenced; it also depends on the Minister of Police first listing the categories of offence by notice, which has not been found. For financial institutions, Joint Standard 1 of 2023 on information technology governance took effect on 15 November 2024 and Joint Standard 2 of 2024 on cybersecurity and cyber resilience took effect on 1 June 2025; the notification template for material technology and cyber incidents was still out for consultation in September 2025, so the precise deadline is not settled.

(1) The enforcement chain is procedural: investigation, then an enforcement notice, then an infringement notice with an administrative fine capped at 10 million rand, then a court application to make it an order. Failing to comply with an enforcement notice is an offence carrying up to ten years' imprisonment. Courts will reduce fines they consider excessive, as in the Blouberg municipality matter in April 2026. (2) Prior authorisation under sections 57 and 58 also covers linking unique identifiers across organisations, processing information about criminal behaviour for third parties, and credit reporting — and processing must stop until the Regulator responds. (3) The Regulations were amended with immediate effect on 17 April 2025 and now state plainly that opt-out does not constitute consent for unsolicited electronic marketing, and that consent requested by telephone or automated calling machine must be electronically recorded and given to the person free of charge on request. (4) Section 17 of the National Health Act makes it a criminal offence to connect a computer holding patient records to another computer or terminal without authority — a live risk for any health system integration or cloud migration. (5) Tax records in electronic form kept outside South Africa need authorisation from a senior revenue service official. (6) A sixth for public bodies: they cannot delete public records without the National Archivist's written authorisation, so honouring a deletion request may itself be unlawful.

Dated items. March 2025: the central bank's payments department proposed a directive under section 12 of the National Payment System Act requiring prior approval before payment institutions use cloud or offshore data, and requiring clearing and settlement data, systems and infrastructure of payment market infrastructures to be located inside South Africa, with cross-border settlement systems excluded; no directive had been issued as at 18 August 2026. May 2025: Joint Communication 2 of 2025 confirmed the Financial Sector Conduct Authority and Prudential Authority are developing a cloud computing and data offshoring Joint Standard, to be published for consultation; nothing published as at 18 August 2026. 26 September 2025: draft regulations on processing health or sex-life data, comments closed 10 October 2025, not yet final. 30 April 2026: the Regulator gazetted its own-initiative code of conduct on processing personal information at gated accesses, covering closed-circuit television and biometric access control, with the comment period extended in May 2026; once issued, breaching a code of conduct counts as interference with the protection of personal information. DORMANT SWITCHES, each flippable without new legislation: section 54 of the Cybercrimes Act, the 72-hour police reporting duty, needs only a presidential proclamation plus a ministerial notice listing offence categories; Chapter 9 of the Electronic Communications and Transactions Act lets the Minister declare classes of information to be 'critical data' and then prescribe binding rules on the storage, archiving, transfer and control of the databases holding it, with no such notice found as at 18 August 2026; the telecommunications retention period is set by ministerial directive within a three-to-five-year band; and the 10 million rand fine ceiling can be raised for inflation by ministerial notice.