What Is POPIA? Protection of Personal Information Act 4 of 2013

POPIA is the Protection of Personal Information Act 4 of 2013. The South African Government describes it as a law that protects personal information processed by public and private bodies, establishes processing requirements, creates the Information Regulator, and regulates issues including direct marketing, automated decision-making, and cross-border flows.

The Act applies to processing personal information in a record by automated or non-automated means where the responsible party is domiciled in South Africa, and in certain cases to a non-domiciled party using means in South Africa. Exemptions and provision-specific conditions still matter; a listing visible from South Africa does not alone prove that every provision applies.

Section 23 allows a data subject who provides adequate proof of identity to ask whether a responsible party holds personal information and to request a record or description of that information, subject to the Act and applicable access-law grounds. Use the organization’s current published privacy or information-officer route and keep the request evidence.

Section 24 allows a request to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and to delete records no longer authorised for retention. The section has conditions and exceptions, so POPIA does not make every broker listing removable on demand.

Section 69 generally prohibits processing personal information for direct marketing by electronic communication unless the data subject consented or the existing-customer conditions apply. Those conditions include a reasonable, free opportunity to object, and marketing communications must identify the sender and provide a contact for stopping further messages.

Send a Form 1 objection or Form 2 correction/deletion request to the responsible party or Information Officer first where appropriate. If the matter is unresolved, submit a written Form 5 complaint through the Information Regulator’s eServices portal or another listed channel. The published rules describe acknowledgement and reference within 14 days, pre-investigation notices within 21 days, a 21-day response period for the responsible party, and an aim to complete pre-investigation within 30 days; the portal’s approximately three-month simple-case and up-to-12-month complex-case periods are practical estimates, not statutory guarantees. A Form 20 internal-review request may be made within 14 days on the current guidance, and a High Court appeal may be available within 180 days; check the official pages before filing.

The notice concerns health-information processing by eight listed responsible-party categories: insurance companies, medical schemes, medical scheme administrators, managed healthcare organisations, administrative bodies, pension funds, employers, and institutions working for those bodies. It does not list general data brokers and does not create a general deletion right for ordinary non-health broker data; POPIA’s ordinary rights and limitations, including section 24 where applicable, remain the relevant framework.

No. POPIA provides rights and regulatory routes, but the result depends on the responsible party, the processing purpose and source, the request facts, statutory exceptions, and the current route. OfflistMe can help draft a request for review and sending; it does not decide legal applicability or guarantee a broker response.