POPI and Data Protection

The protection of personal information, and privacy and data protection laws (including the GDPR and the POPI Act or POPIA) are key laws in today’s information society. Information compliance or information rights are central to so many disputes. Read our insights, regulatory updates, judgment summaries, enforcement action (including fines and notes), data breaches or authority guidance.

Personal data deletion rights: Navigating your responsibilities

Personal data deletion rights aren't just paperwork — they're like removing permanent marker from a whiteboard: simple to describe but tricky to do correctly. Data protection laws now give people more rights to control their personal information. One crucial right [...]

By |2025-04-10T10:45:22+02:00April 8th, 2025|Categories: POPI and Data Protection|Tags: , |
Read More

How do I comply with POPI or POPIA?

Wouldn't it be lovely if there were a comprehensive checklist that could help you comply with POPI or POPIA? Because the Protection of Personal Information (POPI) Act in South Africa is a principle-based law, it is not possible to [...]

By |2025-04-24T14:35:24+02:00April 8th, 2025|Categories: POPI and Data Protection|Tags: , , , , |
Read More

Notification of security compromise to the Information Regulator | Guideline and support

The information regulator published a Guideline on notification of security compromises to the information regulator in July 2020. The guideline explains the procedure responsible parties or information officers should follow to notify the regulator of a security compromise or data [...]

By |2025-04-23T13:35:59+02:00April 7th, 2025|Categories: Cybersecurity Law, POPI and Data Protection|Tags: , , , , , , |
Read More

Advanced Computer Software Group enforcement action | Ransomware

The Information Commissioner’s Office (ICO) has fined Advanced Computer Software Group Ltd (ACSG) £3.07 million following a ransomware incident that exposed the personal data of 79,404 people. The ICO found that ACSG failed to implement adequate security measures, leaving [...]

By |2025-03-27T15:29:26+02:00March 27th, 2025|Categories: POPI and Data Protection|Tags: , , , |
Read More

Nigerian data controller and processor registration

As Nigeria keeps stepping up its data protection game, companies looking to do business there must stay on top of what’s required under the Nigeria Data Protection Act (NDPA) 2023. One key thing to know is that under the NDPA, [...]

By |2025-03-26T09:30:00+02:00March 25th, 2025|Categories: POPI and Data Protection|Tags: , , |
Read More

Construction Education and Training Authority (CETA) v V2 Digital and Another | Data migration

Construction Education and Training Authority (CETA) v V2 Digital and Another case centres on data migration disputes and POPIA's provisions relating to data governance, after CETA terminated its ICT service agreement with V2 Digital. Who should care about this judgment [...]

By |2025-04-23T08:53:08+02:00March 24th, 2025|Categories: Data governance, POPI and Data Protection|Tags: , , |
Read More

Information regulator annual performance plan for 2025 to 2026 APP

The information regulator has presented its draft annual performance plan (regulator APP) for 1 April 2025 to 31 March 2026. It has presented them in different formats to different audiences. For example, the regulator held a stakeholder engagement on 5 [...]

By |2025-03-26T11:52:16+02:00March 5th, 2025|Categories: Access to Information, POPI and Data Protection|Tags: , |
Read More

De Jager v Netcare | Surveillance Evidence and POPIA

In De Jager v Netcare, the High Court considered whether surveillance evidence collected without consent was admissible under the Protection of Personal Information Act (POPIA). The case clarifies when personal information, including special personal information like health data, may be [...]

By |2025-03-29T09:26:59+02:00February 28th, 2025|Categories: POPI and Data Protection|Tags: , , , , |
Read More

Data protection in Bulgaria

Data protection is a critical element of Bulgaria's fast-evolving digital economy. As businesses explore innovative technologies, foreign investment grows, and data-driven services expand, compliance with the GDPR and the Bulgarian Personal Data Protection Act (PDPA) is essential for safeguarding consumer [...]

By |2025-02-25T15:26:37+02:00February 25th, 2025|Categories: POPI and Data Protection|Tags: , |
Read More

CPA amendments: What they could mean for direct marketing

The Department of Trade, Industry, and Competition (DTIC) plans to make CPA amendments to the Consumer Protection Act (CPA) regulations. These CPA regulation amendments aim to address direct marketing practices in South Africa by introducing a National government-run opt-out registry [...]

By |2026-03-09T16:34:45+02:00February 21st, 2025|Categories: Marketing Law, POPI and Data Protection|Tags: , , |
Read More