Protection of Personal Information Act, rights of data subjects

POPIA, ss. 18, 23-25 and 69-71 (the information notice, access and correction, direct marketing and automated decision making)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 July 2020.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not base a decision that has legal or substantially similar consequences for a person solely on automated processing of their personal information, unless the person can make representations about the decision and you have explained the underlying logic of the processing to them.
Before or when you collect personal information, tell the data subject what is being collected and its source, your identity, the purpose of collection, whether supplying it is voluntary or mandatory, any intended transfer to another country, and their rights of access, correction, objection and complaint to the Information Regulator.
On request, confirm free of charge whether you hold a data subject's personal information, and give access to the record within a reasonable time, in a reasonable manner and an understandable form.
Correct or delete personal information a data subject shows is inaccurate, irrelevant, out of date, incomplete, misleading or unlawfully obtained, and tell the data subject what action you took.
Do not process personal information for direct marketing by electronic communication unless the data subject has consented, or is an existing customer given a free and simple chance to opt out at collection and on every marketing contact afterward.
Give a person listed in a public subscriber directory a free opportunity to object to the use of their personal information before including it.

What it reaches

Obligation class

Data subject rights, Disclosure, Consent

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 18 requires a responsible party, when it collects personal information, to take reasonably practicable steps to tell the data subject what is being collected and its source, the responsible party's identity, the purpose of collection, whether supplying the information is voluntary or mandatory, any transfer intended to a third country, and the data subject's rights of access, correction, objection and complaint to the Information Regulator; section 5 catalogues this and the Act's other data subject rights together.

Section 23 gives a data subject the right to confirm, free of charge, whether a responsible party holds their personal information and to access the record within a reasonable time, in a reasonable manner and an understandable form, and section 24 requires the responsible party to correct or delete personal information the data subject shows is inaccurate, irrelevant, out of date, incomplete, misleading or unlawfully obtained, and to tell the data subject what action was taken.

Section 69 prohibits processing personal information for direct marketing by electronic communication unless the data subject has consented or is an existing customer given a free and simple opportunity to object at collection and on every later marketing contact, and section 70 requires a public subscriber directory to give a data subject the chance to object, free of charge, before including their information.

Section 71 bars a decision with legal or substantially similar consequences for a data subject that is based solely on automated processing of their personal information intended to profile them, unless the data subject can make representations about it and the responsible party explains the underlying logic of the processing.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Protection of Personal Information Act 4 of 2013, Government Gazette text hosted by the Information Regulator of South Africa

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app