South Africa

Section 22(1) requires a responsible party, where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, to notify both the Information Regulator and the affected data subject, unless the data subject's identity cannot be established.

Section 22(2) fixes the moment the notification is due from the discovery of the compromise: notification must be made as soon as reasonably possible after that discovery, taking into account the legitimate needs of law enforcement and any measures needed to determine the compromise's scope and restore the responsible party's information system.

Section 22(3) lets the responsible party delay only the data subject's notification, and only where a law-enforcement body or the Regulator determines that notifying would impede a criminal investigation; section 22(4) requires the data subject's notification to be in writing, by at least one of several listed channels, and section 22(5) requires it to describe the compromise's likely consequences, the measures taken or proposed to address it, a recommendation for the data subject, and, if known, the unauthorised person's identity.

Section 21(2) separately requires an operator processing personal information for a responsible party to notify that responsible party immediately on the same reasonable grounds.

Section 3 applies the Act to personal information entered in a record by a responsible party domiciled in the Republic, or using automated or non-automated means there, and section 4 lists the eight conditions for lawful processing that Chapter 3 sets out: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.

Section 8 makes the responsible party accountable for those conditions from when it fixes the purpose and means of processing through the processing itself, and sections 9 to 12 require processing to be lawful, not excessive for its purpose, grounded in the data subject's consent or another listed basis, and ordinarily collected directly from the data subject.

Sections 13 to 16 limit collection to a specific and explicit purpose, bar retaining a record longer than that purpose needs, require further processing to stay compatible with the original purpose, and require the information to be kept complete, accurate and updated.

Sections 19 to 21 require a responsible party to secure the integrity and confidentiality of personal information with appropriate technical and organisational measures against loss, damage or unlawful access, to identify foreseeable risks and keep the safeguards updated, and to bind any operator it uses to the same measures by written contract.

Sections 36 to 38 let the Information Regulator exempt processing that serves the public interest, or clearly benefits the data subject, from one or more of these conditions. Section 55 bars an information officer from taking up duties under the Act until the responsible party has registered that officer with the Regulator.

Sections 57 to 59 require the Regulator's prior authorisation, on pain of prosecution for failing to notify, before processing that links unique identifiers across responsible parties, handles criminal-behaviour or credit-reporting information, or transfers special personal information or a child's information to a country without adequate protection.

Section 72(1) bars a responsible party in the Republic from transferring personal information about a data subject to a third party in a foreign country unless the recipient is subject to a law, binding corporate rules, or a binding agreement that effectively upholds substantially similar processing conditions and substantially similar onward-transfer restrictions, or unless the data subject consents, the transfer is necessary to perform a contract with or for the benefit of the data subject, or the transfer benefits the data subject and consent is not reasonably practicable to obtain but would likely be given.

Section 57(1)(d) separately requires a responsible party to obtain the Information Regulator's prior authorisation before transferring special personal information, or a child's personal information, to a country that does not provide an adequate level of protection.

Section 71(1) bars subjecting a data subject to a decision that has legal consequences for them, or affects them to a substantial degree, when the decision is based solely on the automated processing of their personal information to profile them, including their work performance, creditworthiness, reliability, location, health, preferences or conduct.

Subsection (2) lifts the bar where the decision was taken in connection with concluding or executing a contract and the data subject's request was met or appropriate measures protect their interests, or where a law or code of conduct governs the decision with the same safeguards specified.

Those safeguards must let the data subject make representations about the decision, and require the responsible party to give them enough information about the automated processing's underlying logic to make those representations.

Regulation 2 requires a responsible party to take a data subject's objection to the processing of their personal information at any time during the responsible party's office hours and free of charge. The objection is made on a form substantially similar to Form 1, which the responsible party must make reasonably accessible by hand, fax, post, email, SMS or WhatsApp. A responsible party must also notify the data subject of the right to object when it collects their personal information.

It must record electronically an objection made by telephone and make the recording available to the data subject on request. Regulation 3 gives a data subject the right to ask, at any time and free of charge, for the correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.

The request is made on a form substantially similar to Form 2, which the responsible party must make reasonably accessible by hand, fax, post, email, SMS or WhatsApp message. A request made by telephone must be recorded. The responsible party must notify the data subject in writing of the action taken within thirty days of receipt of the outcome of the request.

The Information Regulator published the amended Regulations in Government Gazette 52523 on 17 April 2025 for implementation with immediate effect.

Section 18 requires a responsible party, when it collects personal information, to take reasonably practicable steps to tell the data subject what is being collected and its source, the responsible party's identity, the purpose of collection, whether supplying the information is voluntary or mandatory, any transfer intended to a third country, and the data subject's rights of access, correction, objection and complaint to the Information Regulator; section 5 catalogues this and the Act's other data subject rights together.

Section 23 gives a data subject the right to confirm, free of charge, whether a responsible party holds their personal information and to access the record within a reasonable time, in a reasonable manner and an understandable form, and section 24 requires the responsible party to correct or delete personal information the data subject shows is inaccurate, irrelevant, out of date, incomplete, misleading or unlawfully obtained, and to tell the data subject what action was taken.

Section 69 prohibits processing personal information for direct marketing by electronic communication unless the data subject has consented or is an existing customer given a free and simple opportunity to object at collection and on every later marketing contact, and section 70 requires a public subscriber directory to give a data subject the chance to object, free of charge, before including their information.

A data subject whose personal information has been interfered with under section 73 of the Act may lodge a complaint with the Information Regulator. A complaint must be made in writing, by completing Form 5 online or at the Regulator's offices. The Regulator must acknowledge receipt of a complaint and give the complainant a reference number within fourteen days after receipt. A complainant who wants their identity withheld must give valid reasons with the complaint.

A responsible party served with an infringement notice who cannot pay the administrative fine in a lump sum may arrange with the Regulator to pay in instalments case by case.

Section 39 establishes the Information Regulator as an independent juristic person with jurisdiction throughout the Republic. The Regulator's establishment under Chapter 5 Part A commenced ahead of most of the Act, since Proclamation R21 of 2020 appointed 1 July 2020 for sections 2 to 38 and sections 55 to 109, a list that leaves out sections 39 to 54.

Section 73 defines interference with the protection of personal information as any breach of the Chapter 3 conditions, non-compliance with sections 22, 54, 69, 70, 71 or 72, or a breach of a code of conduct, and sections 74 to 94 let any person complain to the Regulator, which may conciliate, investigate, refer a matter to its Enforcement Committee, and, under sections 81 to 88, obtain a warrant to enter, search and seize evidence from a responsible party's premises.

Section 95 lets the Regulator serve an enforcement notice requiring a responsible party to take, or stop taking, specified steps, appealable to the High Court within 30 days under section 97, and section 99 lets a data subject, or the Regulator at the data subject's request, bring a civil action for damages against a responsible party for breach of any provision of the Act, regardless of intent or negligence.

Sections 100 to 106 create offences for obstructing the Regulator, breaching confidentiality, failing to comply with an enforcement or information notice, and unlawfully dealing in a data subject's account number; section 107 sets the penalties at up to ten years' imprisonment or a fine, or both, for the most serious of these, and up to twelve months for the rest, and section 109 lets the Regulator impose an administrative fine of up to R10 million by infringement notice, considering factors including the number of data subjects affected and whether the responsible party could have prevented the contravention.

Section 26 prohibits processing personal information about a data subject's religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information (a term the Act's definitions extend to fingerprinting, DNA analysis, retinal scanning and voice recognition), or their alleged criminal behaviour or related proceedings, unless section 27 applies.

Section 27 lifts the prohibition where the data subject consents, the processing is necessary to establish or defend a legal right, historical or research purposes apply, the information was deliberately made public by the data subject, or sections 28 to 33 authorise it for a specific category; sections 28 to 32 set narrower authorisations for religious bodies, race-based redress measures, trade unions, political organisations, and health or insurance processing, each barring disclosure to a third party without the data subject's consent, and section 33 authorises processing criminal-behaviour or biometric information by bodies charged with applying criminal law or by a responsible party that obtained it lawfully.

Section 34 separately prohibits processing a child's personal information unless section 35 applies, and section 35(1) permits it only with a competent person's prior consent, to establish or defend a legal right, to comply with international law, for historical or research purposes, or where the child made the information public with a competent person's consent; the Regulator may also authorise processing of a child's information in the public interest under section 35(2), subject to conditions safeguarding the child under section 35(3).

Section 2 makes it an offence to unlawfully and intentionally perform an act in respect of a computer system or data storage medium that places a person in a position to commit an access, interception, or interference offence, and separately makes it an offence to unlawfully and intentionally access a computer system or data storage medium; a contravention carries a fine or imprisonment of up to five years under section 19(1).

Section 3 makes it an offence to unlawfully and intentionally intercept data, including electromagnetic emissions from a computer system carrying it, or to possess data known or reasonably suspected to have been unlawfully intercepted without a satisfactory exculpatory account; a contravention of section 3(1) or (2) carries a fine or imprisonment of up to ten years under section 19(2).

Both offences require the access or interception itself to be unlawful, so a plain reading does not by itself capture reading a public, unauthenticated page that defeats no access control. The Act's Schedule repealed sections 85 to 88 of the Electronic Communications and Transactions Act 25 of 2002, the earlier statute that had carried South Africa's computer-misuse offences.

Section 52 of the Electronic Communications and Transactions Act provides that Chapter IX applies only to a critical database administrator and critical databases or parts thereof. Section 1 defines a critical database administrator as the person responsible for the management and control of a critical database.

Section 53 lets the Minister, by notice in the Gazette, declare classes of information of importance to the protection of the national security of the Republic or the economic and social well-being of its citizens to be critical data. Section 54(3) defines registration of a critical database as recording specified information about it in a register maintained by the Department or by another body the Minister specifies.

Section 55(1) lets the Minister prescribe minimum standards or prohibitions for the general management of critical databases and for access to, transfer and control of them. Section 57 lets the Director-General cause audits to be performed at a critical database administrator to evaluate compliance with Chapter IX, by cyber inspectors or by an independent auditor.

Section 58(2) makes it an offence for a critical database administrator to fail to take the remedial action within the period stated in an audit non-compliance notice. Section 89 of the Act, as substituted by the Cybercrimes Act, punishes a person convicted of an offence under section 58(2) with a fine or imprisonment for a period not exceeding 12 months. The Electronic Communications and Transactions Act commenced on 30 August 2002.

Paragraph 5.1 of Directive 01 of 2024 requires payment institutions and operators to develop and maintain cybersecurity and cyber-resilience frameworks covering cyber-governance, critical assets, security measures, detection, response and recovery, testing, information sharing, situational awareness and learning. Paragraph 4.1 applies Directive 01 of 2024 to payment institutions, operators and payment system financial market infrastructures.

Paragraph 1.1.14 defines a payment institution as a person designated, authorised, registered or regulated under the National Payment System Act 78 of 1998, including clearing system participants, settlement system participants, third-party payment providers and system operators.

Paragraph 5.1.5.1(d) requires arrangements to resume critical operations within two hours, or an extended timeline the SARB approves in advance, for payment, clearing and settlement systems and payment system financial market infrastructures. Paragraph 5.1.6.1(b) requires internal and external penetration testing of systems and processes through the simulation of cyber-attacks.

Paragraph 6.1 allows the SARB to conduct a supervisory onsite or offsite inspection of payment institutions or operators at any time. Section 12(1) of the National Payment System Act lets the Reserve Bank, after consultation with the payment system management body, issue directives to any person regarding a payment system. Paragraph 7.3 makes contravention of Directive 01 of 2024 an offence under section 12(8) of the National Payment System Act.

Section 14 of the National Payment System Act punishes a person convicted of an offence under section 12(8) with a fine not exceeding R1 million, imprisonment not exceeding five years, or both. Paragraph 7.1 makes Directive 01 of 2024 effective three months after its publication. Government Gazette No. 50665 of 17 May 2024 published the South African Reserve Bank's notice of Directive 01 of 2024.

Section 54(1) of the Cybercrimes Act requires an electronic communications service provider or financial institution that becomes aware that its electronic communications service or network is involved in an offence in Part I of Chapter 2 determined under subsection (2) to report the offence to the South African Police Service without undue delay and, where feasible, not later than 72 hours after becoming aware of it.

Section 54(1)(b) requires the provider or institution to preserve any information which may be of assistance to the South African Police Service in investigating the offence. Section 54(2) requires the Cabinet member responsible for policing to prescribe by notice in the Gazette the category or class of offences that must be reported.

Section 54(3) makes an electronic communications service provider or financial institution that fails to comply with subsection (1) guilty of an offence liable on conviction to a fine not exceeding R50 000. Section 1 defines an electronic communications service provider to include a person who provides an electronic communications service under an electronic communications service licence issued under the Electronic Communications Act, 2005.

Section 1 defines a financial institution as a financial institution as defined in section 1 of the Financial Sector Regulation Act, 2017. The proclamation published in Government Gazette 45562 of 30 November 2021 under section 60 of the Cybercrimes Act fixed 1 December 2021 for the commencement of Chapter 8, with the exclusion of section 54. The President assented to the Cybercrimes Act on 26 May 2021.

Paragraph 5.2.1 of Directive 01 of 2024 requires payment institutions and operators to report material cyber-incidents to the SARB within 24 hours and to provide the SARB with a report within 48 hours of the cyber-attack.

The report must state the date and time of the incident, its cause and source, its type and nature, its impact on the provision of services, the expected recovery period, its impact on stakeholders, the improvement action plan, its possible systemic effect on other payment institutions and systems, and any other information the SARB requests.

Paragraph 5.2.2 requires payment institutions and operators to provide regular updates to the SARB, and further details once the incident has been remediated and operations have resumed.

Paragraph 1.1.5 defines a cyber-incident as a cyber-event that adversely affects the cybersecurity of an information system or the information it processes, stores or transmits, or that violates the institution's security policies, security procedures or acceptable use policies, whether or not it results from malicious activity. Paragraph 4.1 applies Directive 01 of 2024 to payment institutions, operators and payment system financial market infrastructures.

Paragraph 1.1.14 defines a payment institution as a person designated, authorised, registered or regulated under the National Payment System Act 78 of 1998, including clearing system participants, settlement system participants, third-party payment providers and system operators. Section 12(1) of the National Payment System Act lets the Reserve Bank, after consultation with the payment system management body, issue directives to any person regarding a payment system.

Paragraph 7.3 makes contravention of Directive 01 of 2024 an offence under section 12(8) of the National Payment System Act. Section 14 of the National Payment System Act punishes a person convicted of an offence under section 12(8) with a fine not exceeding R1 million, imprisonment not exceeding five years, or both. Paragraph 7.1 makes Directive 01 of 2024 effective three months after its publication. Government Gazette No. 50665 of 17 May 2024 published the South African Reserve Bank's notice of Directive 01 of 2024.

Section 18C lets the Film and Publication Board accredit a commercial online distributor to classify its own films, games, or publications, on condition the distributor applies the Board's classification guidelines and informs the Board of every 'XX' and 'X18' classification it makes, deferring to any classification the Board itself has already made.

Section 18C(6) separately bars distributing any film, game, or publication in South Africa unless it has been classified and carries a clearly visible label showing its age limit and content nature next to the Board's logo. Section 24A(2) makes it an offence, carrying a fine of up to R500,000 or imprisonment of up to five years, to distribute or exhibit an unclassified film, game, or a section 16(2) publication, or one classified 'refused classification' or 'XX'.

Section 24A(3) separately makes it an offence, carrying a fine of up to R750,000 or imprisonment of up to five years, for a person who holds no adult-premises licence and, for films and games, is not registered with the Board as a distributor or exhibitor, to knowingly distribute, exhibit in public, offer for sale or hire, or advertise for sale or hire a film, game, or publication classified 'X18' or one that would have been so classified.

Section 24A(4) separately makes it an offence, carrying a fine of up to R750,000 or imprisonment of up to five years, to knowingly distribute or exhibit to a person under 18 years a film, game, or publication classified 'X18', or one containing explicit sexual conduct that would have justified an X18 classification, regardless of whether the distributor itself holds the relevant registration or accreditation.

Section 12(1)(c) permits fair dealing with a literary or musical work for the purpose of reporting current events in a newspaper, magazine, or similar periodical, or by broadcast, provided the source and author are mentioned.

Section 12(3) permits quoting from a literary or musical work lawfully available to the public, including a quotation from a newspaper or periodical article in the form of a press summary, provided the quotation is compatible with fair practice, its extent does not exceed what the purpose justifies, and the source and author are mentioned; the provision carries no fixed headline-length or short-extract cap distinct from this fair-practice test.

Section 12(7) permits reproducing or broadcasting an article on a current economic, political, or religious topic published in a newspaper, periodical, or broadcast, if the reproduction has not been expressly reserved and the source is clearly mentioned.

Section 12(8)(a) removes copyright altogether from official texts of a legislative, administrative, or legal nature, speeches of a political nature, and news of the day that are mere items of press information, so no copyright ever attaches to such content in the first place.