POPIA Compliance Guide
ℹ️Compliance group: South Africa auto-resolves to
general-privacy-consent by default. For stronger alignment with POPIA — the same opt-in model as GDPR — configure compliance: { type: 'opt-in' } explicitly in your ConsentiSetup config.South Africa's Protection of Personal Information Act (POPIA) — Act 4 of 2013 — came into full force on 1 July 2021. It is enforced by the Information Regulator of South Africa and establishes eight conditions for lawful processing of personal information. POPIA is structurally similar to the EU GDPR and Consenti supports it via regulation: 'popia'.
Official references
The eight processing conditions
| Condition | Summary |
|---|---|
| 1. Accountability | Responsible party must ensure POPIA compliance |
| 2. Processing limitation | Lawful, minimal, and with consent or another ground |
| 3. Purpose specification | Specific, explicitly defined purpose required |
| 4. Further processing limitation | Further use must be compatible with original purpose |
| 5. Information quality | Data must be complete, accurate, not misleading |
| 6. Openness | Data subject must be informed of processing |
| 7. Security safeguards | Reasonable technical and organisational measures required |
| 8. Data subject participation | Rights of access, correction, and deletion |
Key requirements for consent
| Requirement | Detail |
|---|---|
| Compliance Group | Opt-in — voluntary, specific, informed, unambiguous |
| Special information | Explicit consent required (health, religious belief, racial origin, sex life, criminal history, biometrics) |
| Children | Under-18 requires parental/guardian consent (Section 35) |
| Withdrawal | Must be possible at any time; processing must cease on withdrawal |
| Information Officer | Must designate an Information Officer registered with the Regulator |
| Enforcer | Information Regulator of South Africa |
POPIA vs. GDPR
| GDPR | POPIA | |
|---|---|---|
| Opt-in required | Yes | Yes |
| Lawful bases | 6 | 8 Conditions (broader framing) |
| Minor threshold | 16 (Member States may lower) | 18 |
| DPO equivalent | Data Protection Officer | Information Officer (must register) |
| Enforcer | National DPAs / EDPB | Information Regulator |
| GPC | Optional | Not recognised |
Enabling POPIA mode
Frontend widget
ts
new ConsentiSetup({
compliance: { type: 'general-privacy-consent' },
})Profile configuration (dashboard)
json
{
"regulation": "popia"
}ℹ️POPIA Section 18 requires you to notify data subjects of who your Information Officer is. Unlike DPDPA (which has a dedicated
dpdpa profile block rendered automatically), POPIA has no dedicated metadata field yet — add your Information Officer's contact directly in preferenceModal.htmlText via profileOverride or the dashboard's text editor.What Consenti does — and what it doesn't
Everything above is the consent-collection UX layer: opt-in capture, per-category records, withdrawal, and erasure. POPIA is a broader accountability framework than a consent widget can satisfy on its own. Consenti does not:
- Register you as a Responsible Party or appoint an Information Officer with the Regulator (Sections 55–56) — that's an administrative filing you complete outside the product
- File a Prior Authorisation application with the Regulator for processing that requires one (e.g. certain criminal-behaviour or credit-related data under Section 57), if your processing falls into that category
- Guarantee data residency — self-hosting
@consenti/apimeans you control where it runs, not that it runs in South Africa - Satisfy the eight processing conditions as a whole — Consenti's widget covers condition 2 (processing limitation via consent) and part of condition 6 (openness, via disclosure text); the remaining six are organisational obligations
Operator checklist
Beyond configuring Consenti's consent groups, a POPIA-exposed operator still needs to:
- Register/designate an Information Officer with the Information Regulator and publish their contact details (Section 55) — add that contact to
preferenceModal.htmlTextper the callout above - File a Prior Authorisation application before processing any category that requires one, if applicable to your data
- Decide whether
@consenti/apineeds to be hosted inside South Africa for data-residency purposes, and provision that separately if so - Keep the remaining seven processing conditions (accountability, purpose specification, further-processing limitation, information quality, security safeguards, data-subject participation) satisfied at the organisational level — Consenti's widget doesn't audit these
Erasure and access (Section 24)
http
GET /consenti/api/v1/consent/:visitorId
DELETE /consenti/api/v1/consent/:visitorIdFor the widget-side "Forget me" button and the events both sides fire, see the Right to Erasure guide.