POPIA & PAIA 2025: Latest Amendments And CIPC’s Role in Flagging Non-Compliant Companies

The updated POPIA Regulations, effective 17 April 2025, are designed to better protect personal data and hold organisations accountable. For your convenience, we’ve outlined the key regulatory changes introduced by the April 2025 POPIA amendments:

1. Expanded Data Subject Rights:
   People can now object to the use of their personal information—or request corrections—through virtually any communication channel, including SMS, WhatsApp, phone, and email. Businesses must respond to such requests within 30 days.
2. Stricter Direct Marketing Consent:
   The days of casual opt-outs are over. Consent must now be explicit, convenient, cost-free, and tied to a specific communication method. If consent is obtained via phone or an automated system, the call must be recorded and stored for future access.
3. Complaint Clarity & Support:
   Any person with a public or private interest may submit a complaint. It must be in writing, use the prescribed form, and meet all content requirements. Companies must also assist complainants and honour anonymity requests.
4. New Definitions & Cross-Referencing:
   Definitions such as “complainant” and “relevant body” are now aligned with other legislation, ensuring legal consistency.
5. Flexible Penalties:
   Administrative fines may now be paid in instalments, subject to an affordability assessment by the Information Regulator.