poPI

Popi, commonly capitalized as PoPI, refers to the Protection of Personal Information Act in South Africa, a comprehensive data protection law enacted in 2013 to regulate the processing of personal information by public and private bodies. The Act aims to protect individuals’ privacy by establishing a framework for how personal data may be collected, stored, used, and shared.

The scope of PoPI covers processing of personal information by organizations both inside South Africa and that which relates to South African residents. It applies to government agencies and the private sector alike, requiring organizations to justify processing under defined lawful bases and to implement safeguards against misuse or loss of data.

Key provisions include eight conditions for lawful processing: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness (transparency), security safeguards, and data subject participation. The Act also grants data subjects rights such as access to information, correction, deletion, and the ability to object to or restrain processing. Cross-border transfers are restricted unless adequate protections are in place. Organizations must appoint an information officer, maintain records of processing activities, implement appropriate security measures, and notify the Information Regulator and affected individuals in the event of a data breach.

Enforcement is carried out by the Information Regulator of South Africa, which issues guidance and enforces compliance, including penalties for violations. In common usage, popi/PoPI is primarily associated with this data protection framework, though the term can appear in unrelated names or acronyms in other contexts.