Law / South Africa

South Africa

5 of 8 named instruments researched to a stage, across four of the six areas of law we track: 4 in force and 1 proposed. As of 5 September 2026.

  1. AI law none researched
  2. Privacy law 1
  3. Scraping law 1
  4. Cybersecurity law none researched
  5. Age gating law 1
  6. News aggregation law 2

in forceenacted but not yet in forceproposedrepealed, withdrawn or blocked

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Privacy law1 instrument, 1 in force

Research summary (144 words)

South Africa's comprehensive private-sector data-protection regime is the Protection of Personal Information Act 4 of 2013 (POPIA), whose lawful-processing conditions and enforcement machinery commenced on 1 July 2020 with a one-year transitional period, so full compliance and Information Regulator enforcement began on 1 July 2021.

POPIA binds both public and private responsible parties, carries no general carve-out for publicly available personal information, treats biometric information (including voice recognition) as special personal information subject to heightened restrictions, restricts automated decision-making that has legal or substantially similar effect, and conditions any cross-border transfer on an enumerated adequacy, consent, or contractual ground.

A data subject may bring a civil damages action directly against a responsible party for a breach of the Act, and the Information Regulator may issue administrative fines of up to R10 million or refer conduct for criminal prosecution carrying up to ten years' imprisonment.

Comprehensive regime

Protection of Personal Information Act 4 of 2013 (POPIA)

Protection of Personal Information Act 4 of 2013 (POPIA)Protection of Personal Information Act 4 of 2013, Government Gazette text hosted by the Information Regulator of South Africa

In force since 1 July 2020. Binds public and private bodies.

What this law does

Chapter 3 conditions the lawful processing of personal information on a data subject's consent or another listed ground, limits collection and retention to the purpose for which the information was collected, and requires a responsible party (defined to include a public or private body) to keep the information secure.

Section 26 prohibits processing special personal information, including a data subject's religious belief, race, health, or biometric information, unless one of the grounds in sections 27 to 33 applies, and section 22 requires notifying the Information Regulator and the affected data subject as soon as reasonably possible after discovering that personal information was accessed or acquired by an unauthorised person.

Section 71 bars a decision with legal or substantially similar consequences for a data subject that is based solely on automated processing of their personal information intended to profile them, unless the data subject can make representations about it, and section 72 bars transferring personal information to a third party in a foreign country unless that country, or the recipient's binding rules or agreement, provides an adequate level of protection, or another listed ground such as the data subject's consent applies.

A data subject may institute a civil action for damages directly against a responsible party under section 99, and the Information Regulator may issue an administrative fine of up to R10 million under section 109 or refer conduct for prosecution, which for the most serious offences carries a fine or imprisonment of up to ten years under section 107.

What it requires

Scraping law1 instrument, 1 in force

Research summary (315 words)

South Africa has no scraping-specific statute, so general law governs each dimension separately.

The Cybercrimes Act 19 of 2020 criminalises unlawfully and intentionally accessing a computer system or data storage medium, and unlawfully and intentionally intercepting data, but neither offence turns on defeating a technical access control, so reading a public, unauthenticated page falls outside a plain reading of section 2 only to the extent the access is not itself unlawful; no reported South African case has tested a scraper's liability under either section.

That Act's Schedule repealed sections 85 to 88 of the Electronic Communications and Transactions Act 25 of 2002, which previously carried South Africa's unauthorised-access offence, so the earlier ECTA computer-misuse regime no longer applies and the Cybercrimes Act is the current law. No South African court has ruled on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper.

The Copyright Act 98 of 1978 permits fair dealing for research, private study, criticism, review, and reporting current events, and a quotation exception for press summaries, but contains no text-and-data-mining exception; the pending Copyright Amendment Bill, 2017 would add a general fair use exception whose section 12A the Constitutional Court held constitutional in June 2026, but the Bill has not been signed into law, so no text and data mining (TDM)-specific exception currently exists.

South African copyright law confers no sui generis database right; a compilation is protected only as a literary work to the extent it shows sufficient skill or effort in selection or arrangement. The Protection of Personal Information Act 4 of 2013 (POPIA) applies to personal information without a general carve-out for information that is publicly accessible, so scraping personal data from a public South African website remains subject to POPIA's lawful-processing conditions.

No South African statute or reported case establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.

Computer misuse

Cybercrimes Act, unlawful access and unlawful interception of data

Cybercrimes Act 19 of 2020, ss. 2 (unlawful access) and 3 (unlawful interception of data)Cybercrimes Act 19 of 2020, Government Gazette No. 44651 text

In force since 1 December 2021. Binds public and private bodies.

What this law does

Section 2 makes it an offence to unlawfully and intentionally perform an act in respect of a computer system or data storage medium that places a person in a position to commit an access, interception, tool, or interference offence, and separately makes it an offence to unlawfully and intentionally access a computer system or data storage medium; a contravention carries a fine or imprisonment of up to five years under section 19(1).

Section 3 makes it an offence to unlawfully and intentionally intercept data, including electromagnetic emissions from a computer system carrying it, or to possess data known or reasonably suspected to have been unlawfully intercepted without a satisfactory exculpatory account; a contravention of section 3(1) or (2) carries a fine or imprisonment of up to ten years under section 19(2).

Both offences require the access or interception itself to be unlawful, so a plain reading does not by itself capture reading a public, unauthenticated page that defeats no access control. The Act's Schedule repealed sections 85 to 88 of the Electronic Communications and Transactions Act 25 of 2002, the earlier statute that had carried South Africa's computer-misuse offences.

What it requires

Age gating law1 instrument, 1 in force

Research summary (151 words)

South Africa has no social-media minor-access statute, app-store age-verification requirement, or age-appropriate design code, but has an adult-content age-verification and classification regime under the Films and Publications Act 65 of 1996, as amended by the Films and Publications Amendment Act 11 of 2019 (in force since 1 March 2022).

The amended Act lets a commercial online distributor apply to the Film and Publication Board for accreditation to self-classify the films, games, and publications it distributes, and bars distributing any film, game, or publication, whether self-classified or Board-classified, without a clearly visible label showing its age limit and content nature.

Knowingly distributing content classified X18, or content containing explicit sexual conduct that would justify an X18 classification, to a person under 18 years is a distinct offence carrying a fine of up to R750,000 or imprisonment of up to five years, independent of the general offence of distributing unclassified or refused-classification content.

Adult content age verification (AV)

Films and Publications Act, online distributor self-classification and age-restricted content offences

Films and Publications Act 65 of 1996 ss. 18C (self-classification) and 24A(4) (distribution of restricted content to a minor), as inserted and amended by the Films and Publications Amendment Act 11 of 2019Films and Publications Act 65 of 1996, as amended, consolidated text (South African Legal Information Institute)

In force since 1 March 2022. Binds private bodies.

What this law does

Section 18C lets the Film and Publication Board accredit a commercial online distributor to classify its own films, games, or publications, on condition the distributor applies the Board's classification guidelines and informs the Board of every 'XX' and 'X18' classification it makes, deferring to any classification the Board itself has already made.

Section 18C(6) separately bars distributing any film, game, or publication in South Africa unless it has been classified and carries a clearly visible label showing its age limit and content nature next to the Board's logo. Section 24A(2) makes it an offence, carrying a fine of up to R500,000 or imprisonment of up to five years, to distribute or exhibit an unclassified film, game, or a section 16(2) publication, or one classified 'refused classification' or 'XX'.

Section 24A(4) separately makes it an offence, carrying a fine of up to R750,000 or imprisonment of up to five years, to knowingly distribute or exhibit to a person under 18 years a film, game, or publication classified 'X18', or one containing explicit sexual conduct that would have justified an X18 classification, regardless of whether the distributor itself holds the relevant registration or accreditation.

Note and primary source

News aggregation law2 instruments, 1 in force, 1 proposed

Research summary (195 words)

South Africa has no press-publisher neighbouring right and no mandatory platform-to-publisher bargaining code; the Copyright Act 98 of 1978 is the only enacted law reaching an aggregator's reproduction of news content.

Section 12(3) permits quoting from a lawfully public work, including a quotation from a newspaper or periodical article in the form of a press summary, subject to a fair-practice and extent-justified test with source and author attribution, and section 12(8)(a) removes copyright protection entirely from news of the day that are mere items of press information, a hot-news-adjacent carve-out with no reported decision applying it to a systematic aggregator.

No statute or reported case addresses whether a hyperlink is a communication to the public or whether framing changes the answer, and the Act predates the concept of a machine-readable text-and-data-mining opt-out.

The pending Copyright Amendment Bill, 2017 would add a general fair use exception at section 12A reaching reproduction for research, criticism, reporting current events, and other purposes assessed against a four-factor test; the Constitutional Court held in June 2026 that section 12A is constitutional, but the Bill has not been signed into law, so no general fair use or text-and-data-mining exception currently exists.

This page covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.