POPIA explained: the 8 conditions in plain English
Short answer
Join the Kwalify waitlist to collect client documents on WhatsApp and check them against your rules
What is the purpose of the POPI Act?
The POPI Act’s long title starts: "To promote the protection of personal information processed by public and private bodies; to introduce certain conditions so as to establish minimum requirements for the processing of personal information" (long title). Section 2 sets out its purpose:
- It gives effect to the constitutional right to privacy by safeguarding personal information, within justifiable limits. (section 2(a))
- It balances the right to privacy against other rights, particularly the right of access to information. (section 2(a)(i))
- It sets conditions that are the minimum requirements for processing personal information lawfully. (section 2(b))
- It gives people rights and remedies when their personal information is processed against the Act. (section 2(c))
Two words come up all the time. The responsible party decides why and how personal information is processed. The data subject is the person the personal information is about. (section 1)
What are the 8 conditions of the POPI Act?
The POPI Act sets eight conditions. Section 4(1) says: "The conditions for the lawful processing of personal information by or for a responsible party are the following". Sections 8 to 25 set out what each one requires.
| # | Condition | Where in the Act |
|---|---|---|
| 1 | Accountability | Section 8 |
| 2 | Processing limitation | Sections 9 to 12 |
| 3 | Purpose specification | Sections 13 and 14 |
| 4 | Further processing limitation | Section 15 |
| 5 | Information quality | Section 16 |
| 6 | Openness | Sections 17 and 18 |
| 7 | Security safeguards | Sections 19 to 22 |
| 8 | Data subject participation | Sections 23 to 25 |
Each condition below gives the Act’s words, what they mean in plain English, and what they usually mean for a small business. The last part is general guidance, not legal advice: for your own business, check with an attorney.
1. Accountability
- The business that decides why and how information is processed is responsible for meeting all eight conditions, from planning to the processing itself. The Act: "The responsible party must ensure that the conditions set out in this Chapter, and all the measures that give effect to such conditions, are complied with at the time of the determination of the purpose and means of the processing and during the processing itself." (section 8).
For a small business: Someone in the business owns this. Using a supplier to process information for you does not move the responsibility to them.
2. Processing limitation
- Collect only what you need for the purpose: adequate, relevant and not excessive. The Act: "Personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive." (section 10).
- Personal information may be processed if the person consents. The Act: "the data subject or a competent person where the data subject is a child consents to the processing" (section 11(1)(a)).
- Collect it from the person themselves, unless one of the exceptions in section 12(2) applies. The Act: "Personal information must be collected directly from the data subject, except as otherwise provided for in subsection (2)." (section 12(1)).
For a small business: Ask for what you will use, and know which ground in section 11 you rely on, such as consent or a contract with the client. Collect from the client directly where you can.
3. Purpose specification
- Collect for a specific, defined and lawful purpose connected to what the business does. The Act: "Personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party." (section 13(1)).
- Keep records no longer than the purpose needs, unless a law, a contract or the person's consent allows longer, or section 14 otherwise permits it. The Act: "records of personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed, unless …" (section 14(1)).
- Once you may no longer keep a record, destroy, delete or de-identify it as soon as reasonably practicable. The Act: "A responsible party must destroy or delete a record of personal information or de-identify it as soon as reasonably practicable after the responsible party is no longer authorised to retain the record in terms of subsection (1) or (2)." (section 14(4)).
For a small business: Write down why you collect each kind of information, and decide how long you keep it. Some laws set their own periods: check those with your accountant or attorney.
4. Further processing limitation
- Any later use must fit the purpose the information was collected for. The Act: "Further processing of personal information must be in accordance or compatible with the purpose for which it was collected in terms of section 13." (section 15(1)).
For a small business: Before you use information for something new, such as a newsletter, check that it fits the purpose you collected it for, or ask the person first.
5. Information quality
- Take reasonable steps to keep the information complete, accurate, not misleading and up to date. The Act: "A responsible party must take reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading and updated where necessary." (section 16(1)).
For a small business: Give clients an easy way to update their details, and correct records when you learn they are wrong.
6. Openness
- Keep documentation of your processing, as the Promotion of Access to Information Act describes. The Act: "A responsible party must maintain the documentation of all processing operations under its responsibility as referred to in section 14 or 51 of the Promotion of Access to Information Act." (section 17).
- When personal information is collected, the person must be made aware of what is collected, who collects it, why, and the other items in section 18(1). The Act: "If personal information is collected, the responsible party must take reasonably practicable steps to ensure that the data subject is aware of …" (section 18(1)).
For a small business: Tell people, when you collect their information, what you collect, why and who you are, usually in a privacy notice. Section 18(1) lists what it must cover.
7. Security safeguards
- Protect the information with appropriate, reasonable technical and organisational measures against loss, damage and unlawful access. The Act: "A responsible party must secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent …" (section 19(1)).
- A supplier that processes information for you must keep those security measures, under a written contract. The Act: "A responsible party must, in terms of a written contract between the responsible party and the operator, ensure that the operator which processes personal information for the responsible party establishes and maintains the security measures referred to in section 19." (section 21(1)).
- If there are reasonable grounds to believe someone unauthorised has accessed or acquired the information, notify the Information Regulator and, unless they can't be identified, the people affected. The Act: "Where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person, the responsible party must notify …" (section 22(1)).
For a small business: Limit who can see what, keep files off personal phones and shared inboxes where you can, and have written contracts with the suppliers who handle client information for you.
8. Data subject participation
- A person who proves their identity may ask, free of charge, whether personal information about them is held. The Act: "request a responsible party to confirm, free of charge, whether or not the responsible party holds personal information about the data subject" (section 23(1)(a)).
- A person may ask for personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained to be corrected or deleted. The Act: "correct or delete personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully" (section 24(1)(a)).
For a small business: Know how you will answer when a client asks what you hold about them, or asks you to correct or delete it.
What are the main principles of the POPI Act?
The POPI Act doesn’t list main principles. It calls its core rules conditions for the lawful processing of personal information, and there are eight of them (section 4(1)). The table above lists them. Its purpose, in section 2, is to safeguard personal information as part of the right to privacy, set minimum requirements for processing it, and give people rights and remedies.
What is the difference between PAIA and POPIA?
The Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act do different jobs, and each says so in its long title:
| PAIA | POPIA | |
|---|---|---|
| What it is for | PAIA gives effect to the constitutional right of access to information held by the State, and to information held by others that is needed to exercise or protect a right. | POPIA protects personal information processed by public and private bodies, sets minimum requirements for processing it, and establishes the Information Regulator. |
| Who oversees it | The Information Regulator established under POPIA (section 1) | The Information Regulator, which POPIA establishes (long title) |
The two Acts meet in three places:
- The Information Regulator works under both POPIA and the Promotion of Access to Information Act. (POPIA’s long title and PAIA section 1)
- Its purpose includes balancing the right to privacy against other rights, particularly the right of access to information (POPIA section 2(a)(i))
- A request for your own information under section 23 follows sections 18 and 53 of PAIA (POPIA section 25)
How Kwalify looks after client information
When a business uses Kwalify to collect client details and documents, the information is handled like this:
- All of a business’s data stays in South Africa.
- Sensitive answers are redacted.
- Stored files are encrypted.
- Sensitive values are masked until a person with permission taps Show.
- Collected documents are kept for a set retention period.
- Before anyone signs, their consent is recorded, as part of the evidence pack.
Whether your business meets each condition is for your business to decide, with your attorney. See the privacy policy for how this website handles the details you give it.
How Kwalify helps: Kwalify asks your clients for their details and documents on WhatsApp, checks each document against your rules, and sends reminders until everything is in. See client onboarding or how it works. Join the waitlist
Source: Protection of Personal Information Act 4 of 2013 (long title and sections 2, 4, 8 to 25) and Promotion of Access to Information Act 2 of 2000 (long title and section 1), on Acts Online. Checked on 11 October 2026.
FAQ
What is the purpose of the POPI Act?
It gives effect to the constitutional right to privacy by safeguarding personal information when it is processed, within justifiable limits (section 2(a)). It sets conditions that are the minimum requirements for processing personal information lawfully, and gives people rights and remedies when their information is processed against the Act (section 2(b) and (c)).
What are the 8 conditions of the POPI Act?
Accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. Section 4(1) lists them, and sections 8 to 25 set out what each requires.
What are the main principles of the POPI Act?
The Act calls them conditions for the lawful processing of personal information, and there are eight (section 4(1)). Its purpose, in section 2, is to safeguard personal information as part of the right to privacy, set minimum requirements for processing it, and give people rights and remedies.
What is the difference between PAIA and POPIA?
PAIA gives effect to the right of access to information held by the State, and to information held by others that is needed to exercise or protect a right. POPIA protects personal information. The same Information Regulator works under both, and a request under POPIA for your own information follows sections 18 and 53 of PAIA (POPIA section 25).