28/09/2025
The changes in POPIA 2025
Strengthening South Africans’ Privacy and Transparency Rights: POPIA 2013, the April 2025 amended Regulations, and PAIA’s 2022 Landscape
Johannesburg, South Africa — 26 September 2025 — South Africans’ rights to privacy and access to information have been further clarified and strengthened. The Information Regulator has issued amended Regulations to the Protection of Personal Information Act, 2013 (POPIA), effective 17 April 2025, while the Promotion of Access to Information Act 2020 as amended (PAIA) continues to entrench open, accountable governance following key amendments that took effect in recent years.
What POPIA is—and what changed in April 2025
POPIA governs how organisations collect, use, share, and secure personal information. On 17 April 2025, the Information Regulator published amendments to the POPIA Regulations with immediate effect. These amendments streamline and strengthen data-subject rights (objections, corrections/deletions, and consent for direct marketing) with updated prescribed forms and procedure requirements
The simple “optout” is no longer sufficient, organisations are advised as set out by regulation 6 to utilise the form 4 or equivalent as it is mandatory to gain explicit consent from a data subject for the processing of personal information for the purpose of direct marketing through unsolicited electronic communication in terms of sect 69 (2) of the Act, this form 4 must capture the specific goods/services and communication method and its provisions can be applied electronically or over recorded telephone calls herewith link to the form https://inforegulator.org.za/wp-content/uploads/2020/07/FORM-4-APPLICATION-FOR-THE-CONSENT-OF-A-DATA-SUBJECT-FOR-THE-PROCESSING-OF.pdf. The responsibly party of the Organisation must prove that valid, informed consent was obtained by data subjects. This process will affect marketing strategies and plans.
Other changes included
Clarifying roles and definitions (e.g., “complainant,” “complaint,” “day,” “office hours,” “relevant body/bodies”), reducing ambiguity for companies and the public.
Refine enforcement mechanics, including flexibility around the payment of administrative fines and clearer complaint-handling pathways.
Complement the Regulator’s updated data-breach reporting approach, including the e-portal notification process announced in April 2025.
Bottom line, all organisations must update their POPIA forms, processes, and staff training to match the new 2025 rules.
Where PAIA stands in 2025 and what people mean by the “2022 amendments”
PAIA gives everyone the constitutional right to access records held by the state and by private bodies when needed to exercise or protect rights. As set out by The Promotion of Access to Information Act 2020 as amended effective 1 January 2021 it became mandatory that all private companies, regardless of size become legally required to hold and maintain a PAIA manual (Section 51) detailing contact details of Information Officer, the categories of records the organisation holds, how people can access records, applicable fees and remedies available if access is denied.
With POPIA fully in effect from 1 July 2021, the Information Regulator also required companies to register their Information Offices and align PAIA manuals with POPIA compliance. It must also be noted that organisations must now conclude their annual reporting on data requests, even if none, for each financial year on the Information Regulators portal https://eservices.inforegulator.org.za/reporting/default.aspxhttps://eservices.inforegulator.org.za/reporting/default.aspx
How POPIA and PAIA work together
• Two rights, two pillars- POPIA protects your privacy; PAIA protects your right of access. Together they balance openness with protection—ensuring people to get the records they need while safeguarding personal information.
• Information Officers (IOs)- Each public and private body must appoint an IO who is responsible for POPIA compliance and PAIA access processes (manuals, request handling, time frames).
• The 2025 POPIA Regulation updates and the Regulator’s PAIA role means IOs should align their forms, notices, and manuals accordingly.
Requests vs. protection: When a PAIA request includes personal information, POPIA’s conditions apply—disclosure may be limited or redacted to protect privacy while still enabling access to non-personal parts of a record.
• Breach and transparency: If a data breach occurs, organisations must notify the Regulator and affected individuals (per POPIA), and PAIA still enables individuals to request records relevant to protecting their rights.
What organisations should do now
1. Update POPIA forms and processes to the 17 April 2025 Regulation changes (objection, correction/deletion, consent, complaints etc.). Train staff and refresh privacy notices.
2. Review your PAIA Manual (Section 14/51) and request workflows to ensure alignment with the Regulator’s mandates and current forms/guides.
3. Check your breach-response plan against the Regulator’s e-portal reporting practices announced in April 2025.
4. Ensure your Information Officer is registered and that your POPIA and PAIA compliance tracks are integrated.
Infinity Academy boasts two online courses on both POPIA and PAIA
Register on links below
https://iacademy.co.za/product/the-popi-act/ and
Click https://iacademy.co.za/product/the-promotion-of-access-to-information-act-no-2-of-2000-as-amended/
Bonus! enrol and receive a FREE downloadable PAIA and POPIA manual to guide your compliance journey!
