South Africa

Minister Mmamoloko Kubayi addresses delegates at Artificial Intelligence and the Law Conference, 9 Jul

Statement on the Cabinet meeting of 25 March 2026, and Special Cabinet meeting of 1 April 2026

Information Regulator investigation into WhatsApp's privacy policy

On 13 November 2025, the Information Regulator announced a settlement agreement with WhatsApp concerning its 2021 Privacy Policy. The agreement addresses WhatsApp's processing of personal information in South Africa. As part of the settlement, WhatsApp withdrew its legal action and will implement additional transparency measures for users. The case relates to WhatsApp’s amended Privacy Policy in South Africa. Following an assessment, the Regulator issued an enforcement notice, concluding that...

South Africa National Data and Cloud Policy includes new data protection authority

On 31 May 2024, the Department of Communications and Digital Technologies adopted the data and cloud policy, which requires data protection authorities to ensure robust data security and privacy protection. It emphasises investigating breaches, raising public awareness, and periodically assessing privacy practices across government agencies, businesses, and online platforms. The policy highlights that the authorities must be adequately resourced to take enforcement actions, adapt legislation ...

South Africa National Data and Cloud Policy includes cybersecurity measures

On 31 May 2024, the Department of Communications and Digital Technologies adopted the data and cloud policy including measures to enhance cybersecurity regulation. The policy aims to create a secure and inclusive environment for data and cloud services, focusing on data privacy protection and cybersecurity. It mandates the strengthening of the Cybersecurity Hub to address digital threats, and ensuring all government technologies integrate cybersecurity-by-design principles throughout the data...

Data residency obligations in South Africa Draft National Data and Cloud Policy

On 31 May 2024, the South African Department of Communications and Digital Technologies adopted the final national data and cloud policy, including data residency obligations. The policy applies to data management and cloud computing within South Africa. The guideline mandates that government data pertaining to protecting and preserving national security and sovereignty should be stored only on digital infrastructure within South Africa. Further, the policy sets out criteria for the governmen...

Minister Gungubele Keynote Address At National Ai Government Summit 5 April 2024

Film and Publication Board regulations addressing harmful and prohibited content under Section 18H and Section 27A of the Films and Publications Act (Notice No. 4526)

On 11 April 2024, the Film and Publication Board (FPB)’s regulations addressing harmful and prohibited content under Section 18H and Section 27A of the Films and Publications Act (Notice No. 4526) were terminated after the FPB announced its withdrawal. The regulations required service providers to implement measures to prevent the hosting or distribution of prohibited content and report to the FPB the steps implemented. The regulations prohibited content included content inciting violence, p...

Information Regulator investigation into Ram Consulting over alleged non-compliance with POPIA personal data processing requirements

On 27 February 2024, the Information Regulator issued an enforcement notice to FR Ram Consulting, a training institution, for contravening various sections of the Protection of Personal Information Act (POPIA). The Regulator stated that it received a complaint from a data subject who continued to receive direct marketing messages despite multiple attempts to opt-out. The Regulator found that FR Ram Consulting had failed to adhere to POPIA personal data processing requirements and contravened ...

Information Regulator guidance note on application for prior authorisation

On 15 January 2024, the Information Regulator of South Africa, issued a guidance note on processing personal information subject to prior authorisation under the Protection of Personal Information Act. The note applies to responsible parties processing certain types of data requiring prior authorisation under the POPIA, and which includes unique identifiers, credit reporting, criminal behaviour checks, or transferring special personal information or children's data to countries lacking adequa...

Information Regulator Code of conduct on processing personal information by the residential communities council

On 22 September 2023, the Information Regulator opened a public consultation on processing personal information by the residential communities council. The code and outlines obligations including obtaining consent for processing biometric and employee data, ensuring compliance with Protection of Personal Information Act when sharing data with third parties. The code also highlights implementing security measures like encryption and risk assessments under frameworks such as National Institute ...

Local Content Requirement in White Paper on Audio and Audiovisual Media Services and Online Content Safety

On 8 September 2023, the South African Government closed its consultation on the draft White Paper on Audio and Audiovisual Media Services and Online Content Safety. The White Paper includes high-level policy proposals on regulations and principles to modernise the current legal framework on Audio and Audio-visual Content Services (AAVCS). In particular, the White Paper proposes for the South African Content regulatory framework to apply to all AAVCS including new broadcasting services offere...

FPB Industry code on prevention of online harm

On 2 September 2023, the Film and Publications Board of South Africa closes the public consultation on the Industry code on prevention of online harm. The code aims to regulate the online distribution of harmful content such as child pornography, hate speech, and incitement to violence. The code applies to commercial online distributors and social media platforms. The code imposes obligations to prevent the hosting and distribution of prohibited content, ensure consumer support for reporting ...

FPB Guidelines on peer-to-peer video sharing

On 2 September 2023, the Film and Publication Board closes a public consultation on the guidelines on peer-to-peer video sharing. The guideline aims to regulate content sharing on peer-to-peer platforms, prohibiting harmful or illegal content including child pornography, revenge porn, hate speech, and content inciting violence. The guideline applies to users on peer-to-peer platforms, requiring them to secure consent from individuals, respect intellectual property rights, and adhere to privac...

Information Regulator investigation into Dis-Chem Pharmacies Ltd for alleged contravention of the provisions of Protection of Personal Information Act

On 31 August 2023, the Information Regulator issued an enforcement notice in the context of its investigation into Dis-Chem Pharmacies Ltd for contravention of various sections of the Protection of Personal Information Act relating to a security breach affecting around 3.6 million data subjects. It was highlighted that Dis-Chem failed to implement adequate security measures, including addressing the risks of weak passwords and entering into an operator agreement with its third-party service p...

Information Regulator Code of conduct on personal information protection in the direct marketing industry

On 14 July 2023, the Information Regulator closed a consultation on a code of conduct on personal information protection in the direct marketing industry. The code applies to members of the direct marketing association of South Africa. The code imposes obligations such as appointing Information Officers, establishing a compliance framework, conducting Personal Information Impact Assessments, and ensuring that personal information collection is adequate and relevant. It also requires documenta...

Rules of Procedure for Data Protection Enforcement Committee

On 24 March 2023, the public consultation closed on the draft rules for the Data Protection Enforcement Committee. The draft rules outline the duties of the enforcement committee and what types of complaints may be submitted to it. The draft rules also elaborate on the type of evidence that will be considered, the amount of time the committee may take to process the complaint, and the rights of both the complainant and the defendant.

FPB Notice requiring service providers to implement measures to protect children from harmful content

On 26 January 2023, the Film and Publication Board (FPB) Notice requiring service providers to implement measures to protect children from harmful content enters into force. The notice applies to internet access, service providers, and operators of child-oriented services and content services, including online distributors. The notice requires access and service providers to provide information to the FPB regarding minor protection measures taken by them, including displaying safety messages,...

Minister Khumbudzo Ntshavheni launches Artificial Intelligence Institute of South Africa and AI hubs, 30 Nov

Film and Publication Board’s Revised Classification Guidelines for the Classification of Films, Games and Certain Publications

On 1 August 2022, the Film and Publication Board’s Revised “Classification Guidelines for the Classification of Films, Games and Certain Publications” entered into force. The purpose of the Guidelines is to ensure that information is provided to allow adults to make informed viewing, gaming and reading choices, both for themselves and for children; to protect children from exposure to potentially disturbing or harmful contents; punish and criminalise the use of children in and the exposure of...

Content Moderation Regulation in Films and Publications Amendment Act 2022

On 1 March 2022, the Films and Publications Amendment Act 2022 entered into force. The Act prohibits the online publication and distribution of private sexual photographs and films, child pornography, propaganda for war or is an incitement to violence, advocacy of hatred based on identifiable group characteristics, among others.

Cybercrimes Act including data breach notification obligations

On 1 December 2021, certain sections of the Cybercrimes Act entered into force. In particular, all Chapters entered into force with the exception of the following provisions: Part VI of Chapter 1 on Definitions and Interpretations; sections 38(1)(d)-(f), 40(3)-(4), and (41-44)) of Chapter 4 on Powers to Investigate, Search, Access or Seize; section 54 of Chapter 8 on Reporting Obligations and Capacity Building; sections 11B-D, and 56A(3)(c)-(e) of the Criminal Law (Sexual Offences and Related...

Minister Khumbudzo Ntshavheni: Artificial intelligence regulation while encouraging innovation

Data governance regulation in Guidance note on the processing of special personal information

The guidance note on the processing of special personal information is adopted by the Information Regulator of South Africa, establishing a guideline for responsible parties who are required to obtain authorisation from the Regulator to process special personal information, as provided for in section 27(2) of the Protection of Personal Information Act ('POPIA'). Referring to the POPIA, the guidance note gives a short overview about the requirements, which have to be met in order to get an aut...

Information Regulator Guideline to Develop Codes of Conduct under POPIA

On 1 March 2021, the Guideline to Develop Codes of Conduct under the Protection of Personal Information Act (POPIA) came into effect. The Guideline was developed by the Information Regulator to explain the process for the adoption of industry-specific codes of conduct under Section 65 of POPIA.

Data protection rules in Protection of Personal Information Act (POPIA)

On 1 July 2021, the Protection of Personal Information (POPIA) was fully implemented after Section 58(2) came into effect. Adopted in 2013, the POPIA applies to public and private “responsible parties” that process personal information (e.g. collect, receive or use data). The POPIA requires entities to obtain consent for the processing of personal information, enabling justifications such as contractual performance, legal obligations and legitimate interests of the data subject. Data subjects...

AI must open doors for all women

Through SA Connect, government is working to expand broadband connectivity and community Wi-Fi, particularly in underserved communities , while the National Digital and Future Skills Strategy is aimed at equipping South Africans with skills for ...

Innovation meets impact as Minister Buthelezi launches Batho Pele AI chatbot

The Minister thanked Meta and Juicetel for their collaboration with the government and encouraged other departments to leverage similar technologies to improve service delivery, while stressing that responsible use of AI must be guided by proper governance, and that public servants retain responsibility for ensuring accurate information is disseminated.

DPSA to launch Batho Pele AI Chatbot

Public Service and Administration Minister Inkosi Mzamo Buthelezi will lead the launch of the Batho Pele artificial intelligence (AI) Chatbot , a new digital tool aimed at giving public servants instant access to public service policy updates, ...

Kubayi addresses AI and the Law conference

Minister of Justice and Constitutional Development Mmamoloko Kubayi has warned that artificial intelligence (AI) systems largely trained on foreign datasets risk perpetuating racial bias and undermining South Africa’s transformative constitutional vision if they are not infused with local ...

Cabinet approves withdrawal of AI policy

Cabinet has approved the withdrawal of the Draft National Artificial Intelligence (AI) Policy , which was published for public comment in March 2026. “Cabinet approved the withdrawal of the draft AI policy, which was published for public comment ...

Statement on the Cabinet meeting of Wednesday, 3 June 2026

5. Withdrawal of the Draft Artificial Intelligence (AI) Policy

Statement on the Cabinet meeting of 3 June 2026 and the Special Cabinet meeting of 13 May 2026

5. Withdrawal of the Draft Artificial Intelligence (AI) Policy

Happening in Parliament This Week - Parliament of South Africa

Portfolio Committee on Communications and Digital Technologies (National Assembly), [Adoption of Minutes (17 March 2026 and 15 May 2026) Briefing by Department on the implications of the withdrawal of the AI Policy, way forward and consequence management.

Draft South Africa National Artificial Intelligence (AI) Policy

and enforce governance. Further, this policy actively repositions the Independent · Communication Authority of South Africa (ICASA) for an AI-driven regulatory future. While traditionally focused on broadcasting, telecommunications, and postal services, This gazette is also available free online at www.gpwonline.co.za · STAATSKOERANT, 10 April 2026 · No. 54477 29 · Page 27 of 86 ·

Youth challenged to shape global AI governance

Minister of Women, Youth and Persons with Disabilities Sindisiwe Chikunga has challenged young people to take the lead in setting global standards for artificial intelligence (AI) governance to ensure the technology advances equity, rather than deepens global inequality. Delivering the keynote address at the 4th BRICS Youth Innovation Summit 2026, currently underway at Tshwane University of Technology, Chikunga positioned youth as central actors in shaping a more just and multipolar global or...

Minister announces withdrawal of draft AI Policy

The draft AI policy was approved by Cabinet on 25 March 2026 (combined with the Special Sitting of Cabinet on 01 April 2026), for public comment. In the · Government Gazette dated 10 April, the public had until 10 June 2026 to comment on the bill.

National Artificial Intelligence Policy Framework (Draft) — Department of Communications and Digital Technologies

AI law in South Africa: The Department of Communications and Digital Technologies (DCDT) published the draft National Artificial Intelligence Policy Framework as a foundational, principle- and risk-based roadmap to guide South Africa’s AI policy and future legislation. The Framework prioritises human-centred AI, alignment with data-protection law (POPIA), risk-tiering for high-impact systems, capacity building, research and innovation, and multi-stakeholder governance while inviting public comment and further statutory design....

Regulations relating to the Protection of Personal Information, 2018 (Government Notice R1383 of 2018)

AI law in South Africa: The Regulations relating to the Protection of Personal Information, 2018 (GoN R1383) were made by the Information Regulator under POPIA to prescribe forms, procedural rules, and minimum administrative requirements to operationalise data subject rights, complaints and enforcement processes under the Protection of Personal Information Act (POPIA). They set out duties for information officers, standardized forms for objections, corrections, codes of conduct, complaints, assessments and enforcement notices, and specify procedural timelines and remediation steps....

Protection of Personal Information Act (POPIA), No. 4 of 2013

AI law in South Africa: The Protection of Personal Information Act (POPIA), No. 4 of 2013, establishes comprehensive data protection rules in South Africa, setting out conditions for lawful processing of personal information, rights for data subjects, obligations for responsible parties and operators, and enforcement powers for the Information Regulator. Most operative provisions commenced on 1 July 2020 with enforcement action following the one-year grace period ending 30 June 2021....