POPIA in Practice: a 2026 Data-Protection Baseline

POPIA is South Africa's data-protection law, and meeting it is now a baseline operating requirement — enforced, after years of grace, by a regulator that has started issuing fines.

The Protection of Personal Information Act 4 of 2013 (POPIA) became fully enforceable on 1 July 2021. For much of the period since, the Information Regulator educated more than it punished. That posture has changed.

This piece refreshes earlier guidance Kettle published on keeping data safe when teams work remotely. The remote-work question has not gone away, but it is now one strand of a wider obligation: a documented, defensible data-protection baseline that an organisation can show a regulator on request.

What follows sets out the parts of the Act that matter most in 2026 — the eight conditions, the split between responsible party and operator, the security and breach-notification duties, the rules on direct marketing — and closes with a baseline checklist for South African organisations.

The eight conditions for lawful processing

POPIA does not prohibit the use of personal information. It conditions that use. Chapter 3 of the Act sets out eight conditions for the lawful processing of personal information, and every act of processing must satisfy all eight.

1. Accountability — the responsible party must give effect to the conditions and remains answerable for compliance.
2. Processing limitation — process lawfully, minimally, and with a valid justification such as consent, a contract, or a legal obligation.
3. Purpose specification — collect for a specific, explicitly defined and lawful purpose, and do not keep records longer than necessary.
4. Further processing limitation — any further use must be compatible with the original purpose.
5. Information quality — keep personal information complete, accurate, and updated where needed.
6. Openness — maintain documentation of processing and be transparent with data subjects about what is collected and why.
7. Security safeguards — secure the integrity and confidentiality of personal information through reasonable measures (section 19).
8. Data subject participation — let people access, correct, and delete their personal information.

The conditions are not a menu. A lawful ground under the processing-limitation condition does not excuse a failure on security, and strong security does not cure the absence of a lawful ground. The Information Regulator's enforcement record shows both failure modes.

Responsible party or operator: who carries the duty

POPIA allocates duties through two defined roles. A responsible party determines the purpose and means of processing. An operator processes personal information for a responsible party under a contract or mandate, without coming under that party's direct authority — a payroll bureau, a cloud host, a call centre.

The distinction decides accountability. Under sections 20 and 21, an operator may process only with the responsible party's knowledge or authorisation, must treat the information as confidential, and must tell the responsible party immediately when there are reasonable grounds to believe a breach has occurred.

Section 21 also requires a written contract between the parties obliging the operator to maintain the security measures set out in section 19. Where no such contract exists, the responsible party stays accountable for the operator's non-compliance. The contract is not paperwork; it is the mechanism that keeps liability where the Act intends it.

Security safeguards and breach notification

Section 19 is the operational heart of POPIA. It requires the responsible party to secure the integrity and confidentiality of personal information by taking reasonable technical and organisational measures to prevent loss, damage, unlawful access, and unauthorised destruction.

The duty is active, not a one-off. A responsible party must identify reasonably foreseeable internal and external risks, establish safeguards against those risks, verify that the safeguards are implemented, and keep them current as threats change. Generally accepted information security practices and any sector-specific rules feed directly into what counts as reasonable.

Section 22 governs what happens when a safeguard fails. Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovering the compromise.

The notice to data subjects must carry enough detail for them to protect themselves: the likely consequences of the compromise, the measures the organisation is taking, and what the affected person should do. From 1 April 2025 the Information Regulator requires security-compromise notifications through its online portal — a change that turns timely reporting into an auditable event.

Direct marketing under section 69

Direct marketing is where POPIA touches the widest range of organisations. Section 69 prohibits direct marketing by unsolicited electronic communication — email, SMS, automated calls — unless the data subject has consented, or is an existing customer marketed to within the narrow terms of section 69(3).

Consent is opt-in, requested in the prescribed manner, and a responsible party may approach a person only once to obtain it. The POPIA Amendment Regulations that commenced on 17 April 2025 make the position sharper: an opt-out mechanism does not amount to consent. Pre-ticked boxes and "unsubscribe to decline" do not satisfy the Act.

The Information Regulator's December 2024 Guidance Note on Direct Marketing added a further point of reach: a telephone call is an electronic communication for the purposes of section 69. Outbound marketing calls to non-customers therefore require prior consent, not merely an opt-out at the end of the call.

The Information Regulator's enforcement posture

The Information Regulator is the independent body established under section 39 of POPIA to monitor and enforce both POPIA and the Promotion of Access to Information Act 2 of 2000 (PAIA). Its enforcement toolkit runs from an enforcement notice — a compulsory instruction to remediate — to an infringement notice carrying an administrative fine of up to R10 million under section 109, and referral for criminal prosecution under section 107.

The first administrative fine landed on a public body. On 4 July 2023 the Information Regulator issued the Department of Justice and Constitutional Development with a R5 million fine for failing to comply with an earlier enforcement notice. The underlying compromise was a 2021 ransomware attack that followed lapsed anti-virus and security-software licences.

Other actions have followed across the public and private sectors. FT Rams Consulting was fined R100,000 over direct-marketing complaints; Lancet Laboratories R100,000 for breach-notification failures under section 22; and Blouberg Local Municipality R500,000 for the unlawful online disclosure of a former employee's information.

Enforcement is also being tested in court. A R5 million infringement notice issued to the Department of Basic Education in December 2024, over the publication of matriculants' results without a lawful ground, was set aside by the Pretoria High Court in December 2025; the Information Regulator has signalled an appeal. The boundaries of the Act are now being drawn through litigation, not only guidance.

Compliance is no longer the question of whether the Information Regulator will act. It is whether an organisation can show, on the day it is asked, that it already had a baseline in place.

The pressure is structural, not episodic. The Information Regulator received 2,374 security-compromise notifications in 2024/25 — about 198 a month — and reported a roughly 40% rise in the monthly rate in early 2025/26. Rising cyber-incident volume and a fuller enforcement toolkit point in one direction.

A 2026 data-protection baseline checklist

A defensible baseline is not a privacy policy on a website. It is a set of artefacts an organisation can produce when the Information Regulator, an auditor, or a data subject asks. Eight items carry most of the weight.

1. Appoint and register an Information Officer, and equip that person with authority, a budget line, and a deputy where the organisation is large.
2. Maintain a record of processing activities — what personal information is held, why, where it sits, and how long it is kept.
3. Confirm a lawful ground for every processing purpose, and retire any processing that lacks one.
4. Sign section 21 operator contracts with every third party that processes personal information, each binding the operator to section 19 security measures.
5. Document section 19 safeguards — access controls, encryption, patching, licence renewal, and a tested backup and recovery plan.
6. Run a breach-response plan against the section 22 clock, including the Information Regulator's online notification portal and a template data-subject notice.
7. Move direct marketing to genuine opt-in consent and keep an auditable consent record for each contact.
8. Compile the PAIA manual and the prescribed POPIA forms, and review the whole baseline annually as the threat and regulatory picture shifts.

None of these items is exotic. Each is the kind of artefact a regulator expects to see and an auditor can test. Taken together they convert POPIA from an abstract risk into a managed control environment — which is the practical meaning of a data-protection baseline.

The grace period is over, and the cost of waiting now has a number attached to it. Organisations that build the baseline before an incident forces the issue will treat a security compromise as a controlled event. Those that wait will meet the Information Regulator on its terms rather than their own.