For consumers, POPIA is the legal basis behind those "we value your privacy" consent pop-ups, and it gives real recourse if a business mishandles personal data, including the right to complain to the Information Regulator. For business owners, especially those handling customer databases or payment details, POPIA compliance isn't optional: non-compliance can carry real penalties, and a serious data breach carries reputational risk on top of legal exposure.
Source: Information Regulator (South Africa)
Frequently Asked Questions
Does POPIA apply to small businesses, or only large companies?
It applies to any business that processes personal information, regardless of size — a small business with a customer email list is still subject to POPIA.
What can a person do if they believe their data has been misused?
They can lodge a complaint with South Africa's Information Regulator, which has powers to investigate and take enforcement action.
Does POPIA stop businesses from sending marketing emails altogether?
No, but it generally requires consent or an existing customer relationship before sending direct marketing, and always requires a clear way to opt out.