New amendments to POPIA regulations: What businesses need to know

These amendments bring several important changes that businesses must be aware of to ensure compliance and to protect personal information.

A copy of the final version of the Regulations is available on the Information Regulator’s website at:

POPIA-2021-Regulations-FINAL-21-Jan-2025.pdf.

Enhanced Definitions and Clarity

The amendments to Regulation 1 (Definitions) introduce new or revised definitions for key terms, namely, "complainant" and "complaint", "day", "office hours", "relevant body/bodies", and "writing." These definitions clarify terms used in the Regulations, helping businesses to understand and comply with POPIA more effectively and efficiently.

The amended Regulations provide broader access for data subjects to exercise their rights and remedies under POPIA.

Objection to Processing, and Request for Correction or Deletion, of Personal Information

Regulation 2 (Objection to Processing of Personal Information) and Regulation 3 (Request for correction or deletion of personal information or destruction or deletion of record of personal information) have been updated to improve and broaden the process for data subjects to object to the processing of, and to request the correction or deletion of, or destruction or deletion of record of, their personal information. Under the revised Regulations, such objections and requests can be submitted via various methods, including by hand, fax, post, email, SMS, and WhatsApp, and also by telephone, provided that the objection or request is recorded (by the responsible party), and made available on request.

The strict requirement to use the prescribed forms has been removed, provided that the objection or request is on a form substantially similar to the templates. Any objection or request must be free of charge. Responsible parties are required to notify data subjects of their right to object when collecting personal information.

Responsible parties must notify data subjects of the action taken in respect of a request for correction or destruction within 30 days of receiving the outcome of the request.

Consent for Direct Marketing

The amended Regulation 6 (Request for a data subject's consent to process personal information for direct marketing through unsolicited electronic communication) requires businesses to obtain explicit written consent from data subjects for direct marketing through unsolicited electronic communication, ‘on a form substantially similar to Form 4 or in any manner that may be expedient’. Consent requests can be made via email, telephone, SMS, WhatsApp, facsimile, or automated calling machines. Telephonic and automated calling machine requests must be recorded and made available to the data subject upon request, free of charge.

Clarification has also been provided regarding the so-called ‘opt-out’ options, in that it is expressly stated that ‘(f)or the purposes of direct marketing through unsolicited electronic communications, opt-out shall not constitute consent as referred to in section 69 (2) of the Act.’

Lodging Complaints

The additional provisions in Regulation 7 (Submission of complaint) formalise the process for lodging complaints with the Information Regulator, including detailing who may lodge a complaint, the process to be followed, the information required, and the assistance that will be provided by the Information Regulator. Complaints can be submitted online, or at designated offices, via fax, post, courier, or email. The Regulator will acknowledge receipt of the complaint and provide a reference number within 14 days. All assistance by the Information Regulator is to be provided free of charge.

Administrative Fines

New Regulation 13 (Administrative Fines) provides that administrative fines for non-compliance can be paid in instalments based on the business's financial circumstances. This structured approach encourages adherence to the Regulations and helps businesses manage financial penalties more effectively.

Transitional Provisions

Actions taken under previous Regulations are recognised under the new amendments, ensuring continuity and legal certainty.

How to Ensure Compliance

While the amended Regulations provide some much-needed certainty and clarity, they also place additional obligations and requirements on businesses. In order to remain compliant with POPIA, businesses should take the following steps.

1. Compliance Requirements: update policies and procedures to align with the amended Regulations.
2. Enhanced Data Subject Rights: set up systems to handle objections, corrections, deletions, or destruction requests efficiently and free of charge.
3. Direct Marketing: revise marketing strategies to obtain and record explicit consent from data subjects.
4. Complaint Handling: handle complaints effectively and provide all required information and assistance to data subjects.
5. Administrative Fines: take all reasonable steps required under POPIA and the Regulations, to adhere to the Regulations, as non-compliance can result in fines.
6. Reputation and Trust: compliance (and especially transparency) helps build trust with customers by demonstrating a commitment to protecting personal information.
7. Operational Adjustments: invest in staff training, IT system updates, and possibly additional personnel, to manage compliance efforts effectively.

If you need any assistance with implementing these changes and ensuring that you remain compliant with POPIA, you can get in touch with our Technology, Media, and Telecommunications team, who can assist you with any queries.