Protection of Personal Information Act

Abstract

The Protection of Personal Information Act (POPIA) is South Africa’s data protection law. It effectively manages risks associated with sensitive research data while ensuring transparency. The implementation of POPIA in research settings depends on the proactive development of specific tools and frameworks by institutions to fully support researchers in complying with these principles.

POPIA establishes conditions under which personal data, including research data, can be processed. These include accountability, purpose limitation, data minimization, and security safeguards. Sensitive research data must be processed in a manner that protects the rights and interests of data subjects, ensuring minimal risk exposure. POPIA emphasizes the importance of anonymizing or pseudonymizing personal data to ensure that data subjects cannot be re-identified in research datasets. Organizations handling personal data are required to implement technical and organizational safeguards against unauthorized access, data loss, or destruction. This applies to research institutions ensuring secure environments for sensitive data sharing, such as controlled access systems or "safe rooms" for certified users.

POPIA provides data subjects with the right to know how their data is collected, processed, and shared. Research institutions must clearly communicate the purposes of data collection and the conditions for access or reuse. In cases of data breaches, POPIA mandates prompt notification to both the data protection regulator and the affected data subjects.

Research involving personal data is subject to ethical clearance, aligning with POPIA's principles.

Overview

Country	South Africa
Start date	2021
Annual Budget	n/a
Responsible organisation(s)	Government agency
Target group(s)	The act targets businesses, public sector bodies, researchers, and the general public
Policy instrument type	This is a legislative measure (Regulation)

Background

It was enacted in 2013 but became fully effective on July 1, 2021, following an eight-year phased rollout to allow organizations to align their systems and practices with its requirements. It aligns with EU’s General Data Protection Regulation (GDPR) and the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. It aligns with the National Research Foundation (NRF) Open Access Policy (2015) for NRF funded research by providing a framework for handling sensitive data, ensuring that Open Access requirements do not violate privacy rights.

Objective(s)

To ensure that sensitive research data must be processed in a manner that protects the rights and interests of data subjects, guaranteeing minimal risk exposure.

Public access URL

https://popia.co.za/

All tags

• Data governance for trust
• South Africa
• 2021
• Government agency
• Civil society
• Established researchers
• Firms
• Higher education institutes
• International entity
• National government
• Private R&D
• Public research institutes
• Subnational government
• Strategies, agendas and plans
• Risk management and mitigation

This work is published under the responsibility of the Secretary-General of the OECD. The opinions expressed and arguments employed herein do not necessarily reflect the official views of the Member countries of the OECD.

This document, as well as any data and map included herein, are without prejudice to the status of or sovereignty over any territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area.

© OECD 2025

   Attribution 4.0 International (CC BY 4.0)

This work is made available under the Creative Commons Attribution 4.0 International licence. By using this work, you accept to be bound by the terms of this licence (https://creativecommons.org/licenses/by/4.0/).

Attribution – you must cite the work.

Translations – you must cite the original work, identify changes to the original and add the following text: In the event of any discrepancy between the original work and the translation, only the text of original work should be considered valid.

Adaptations – you must cite the original work and add the following text: This is an adaptation of an original work by the OECD. The opinions expressed and arguments employed in this adaptation should not be reported as representing the official views of the OECD or of its Member countries.

Third-party material – the licence does not apply to third-party material in the work. If using such material, you are responsible for obtaining permission from the third party and for any claims of infringement.

You must not use the OECD logo, visual identity or cover image without express permission or suggest the OECD endorses your use of the work.

Any dispute arising under this licence shall be settled by arbitration in accordance with the Permanent Court of Arbitration (PCA) Arbitration Rules 2012. The seat of arbitration shall be Paris (France). The number of arbitrators shall be one.