On 26 November 2013, the Protection of Personal Information Act (POPIA) was enacted into law. On 11 April 2014, the President issued a notice for commencement of certain sections, including:

• The definitions;
• Legislation pertaining to the establishment and operation of the Information Regulator; and
• The power for the Minister of Justice and the Information Regulator to make and publish Regulations to give effect to POPIA and the procedural sections relating thereto.

On 1 December 2016, the office of the Information Regulator was established and five requisite members were appointed by the President to serve a period of five years.

Following a seven year long wait since the enactment of POPIA, we are pleased to confirm that POPIA will finally come into force on 1 July 2020, with the exception of certain provisions coming into force on 30 June 2021. According to the Presidential statement issued today, 22 June 2020, it was announced that the following sections shall come into force on 1 July 2020:

• The purposes and application provisions,
• The 8 conditions for lawful processing,
• The restrictions on processing of special personal information and personal information relating to children;
• The exemption provisions;
• The provisions relating to Information Officers; 
• Prior authorization requirements;
• Code of conduct provisions;
• Direct marketing and automated decision making provisions;
• Provisions relating to transborder flows;
• The enforcement, offences and sanctions provisions;
• Certain general provisions relating to fees and the transitional arrangements.

(Sections 2 to 38; sections 55 to 109; section 111 and section 114 (1) (2) (3))

To allow for operational readiness of the Information Regulator, the following sections, will only come into force on 30 June 2021:

• The amendment of laws; and
• The effective date of transfer of functions of the Promotion of Access to Information Act from the South African Human Rights Commission to the Information Regulator.

(Sections 110 and 114 (4))

There will be a one-year grace period within which to comply with POPIA and the Regulations enacted thereunder. Private and public bodies should ensure compliance by 1 July 2021.