Legal updates and opinions
News / News
Business must protect the data of all South Africans
If your business has met all the requirements of European data privacy regulations, do you then also comply with South Africa’s Protection of Personal Information Act (POPIA)?
Not necessarily.
Although the General Data Protection Regulation (GDPR) and POPIA share many similar requirements, there are some differences.
The GDPR applies to companies in the European Union (EU), as well as organisations outside the EU that offer goods or services or process personal data of EU citizens. POPIA promotes the constitutional right to privacy of South African individuals and companies by safeguarding the personal information of natural persons and identifiable juristic persons.
Many South African companies with cross-border operations have to be GDPR compliant.
But these companies need to consider the particular nuances of South African society when complying with local data privacy legislation. The main consideration is whether the way in which you are processing personal information is in line with public interest.
So what should companies do?
First and most important, companies need to clearly understand their customers. Think about education levels, literacy, access to technology and geographical location, among others.
Armed with a deep understanding of their customers, companies must then communicate about the use of personal information in a way that is easily understandable to their audience.
The onus to communicate clearly to customers will be higher when complying with POPIA than GDPR given the differences in education levels and sophistication of South African consumers compared to Europeans. South Africa is not only one of the most unequal countries in the world, its education levels also vary considerably across the population. Also, consider that the average person in the European Union is expected to undertake 17.6 years of education over their lifetime (Statista.com). In South Africa the average is 13,5 years (UN Development Programme).
South African companies need to put a lot of thought into making sure they really understand their customers. They need to use plain language in their communications. Should they wish to rely on consent when processing personal information, they will be required to demonstrate that they obtained proper informed consent from a customer. That customer must fully understand that their personal information is being collected and processed and for what purpose. Everyone in society has the exact same right to the privacy of information. Companies need to start thinking about whether their data protection processes cater for the nuances of South African society.
Latest News
New Code of Good Practice: Dismissal
by Anastasia Vatalidis, Director and Anna Tchalov, Associate On 4 September 2025, the new Code of Good Practice: Dismissal ("New Code") [...]
Balancing union duties and job performance: Association of Mineworkers & Construction Union obo Ntuli v Ferroglobe Silicon Smelters (Pty) Ltd
by Jacques van Wyk, Director and Mike Searle, Candidate Attorney In the construction and engineering sectors, senior employees often [...]
The slippery slope of financial distress
by Eric Levenstein, Director and Head of Insolvency and Business Rescue and Brendan Olivier, Director Negative economic news stories [...]
Reinstatement – not always fair
by Bradley Workman-Davies, Director South Africa’s labour law often elevates reinstatement as the primary remedy for unfair dismissal, but [...]
National Minimum Wage Act: What employers need to know about the 2026 review
by Andre van Heerden, Director, Bradley Workman-Davies, Director and Jacques van Wyk, Director South Africa’s National Minimum Wage Act [...]
Tanzania introduces Trade Mark Rights Recordation for all imports
by Donvay Wegierski, Director and Andreya John, Candidate Attorney As of 1 December 2025, in an initiative administered by the [...]