1.1 How Data Protection Works in South Africa (Start Here)

Every organisation collects information about people: customers, employees, job applicants, suppliers’ staff, website visitors and people caught on CCTV. Data protection law sets the rules for how that information may be collected, used, shared, kept and destroyed, and gives people rights over it.

This course is for everyone who handles personal data at work, and for suppliers that handle data for their clients, such as payroll bureaus, IT and cloud providers and call centres, because the law places duties on them too.

Why data protection law exists

Personal data is valuable. It lets a business serve customers, pay staff and plan. It is also a liability: when it is lost, stolen, misused or simply kept too long, real people can suffer fraud, discrimination, embarrassment or danger. The law lets organisations use personal data for legitimate purposes, provided they do so fairly, openly and securely, and can prove it.

The data lifecycle

Data protection applies at every stage of the information’s life:

1. Collect: decide what you need and tell people why you are collecting it.
2. Use: use it only for the purposes you stated, on a lawful basis.
3. Store: keep it accurate and secure.
4. Share: disclose it only where the law allows, with proper contracts in place.
5. Transfer: send it abroad only through an approved route.
6. Retain: keep it no longer than you need it.
7. Delete: destroy it securely when the retention period ends.

The main roles

The same organisation can be a controller for some data and a processor for other data. A payroll bureau, for example, is the controller of its own employees’ records and a processor of its clients’ payroll data (lesson 1.3).

The data protection laws

In South Africa the regulator is the Information Regulator, inforegulator.org.za.

How figures are used in this course

Fines, fees, response times and notification periods in the lessons are examples of the law as at 2026. They are not permanent rules: South Africa changes them through amending Acts, regulations, regulator guidance and court decisions. All the figures are gathered in a Course reference table at the end of lesson 5.4, dated so you can see how old they are.

Before you take a decision that depends on a figure or a deadline, confirm it through official channels.

Example: Bursar Nomvula Mahlangu mapped the personal information held by a Bloemfontein private school: parents’ contact and fee records, pupils’ reports and medical notes, staff files and gate CCTV. For each she noted why it was collected, where it sat, who saw it, what went to the school’s payroll bureau and IT provider, and when it would be destroyed. The map became the school’s first data inventory.

For controllers and processors

• If you are the controller: you are accountable for every stage of the lifecycle, including the stages your suppliers carry out for you.
• If you are a processor or supplier: you handle someone else’s data under their instructions, and the law gives you duties of your own.

Check before you act: Fines, fees and time limits here are 2026 examples, not fixed rules, and are expected to change. Confirm the current position with the Information Regulator (inforegulator.org.za), the Government Gazette or a qualified data protection or legal adviser.

Key takeaway

Data protection law lets organisations use personal data for legitimate purposes, provided they handle it fairly, openly and securely at every stage of its life and can prove they do. Controllers decide why and how data is used; processors act for them; the regulator enforces the rules.