Does POPIA protect company information?
Yes — by express definition. Many businesses assume privacy law is about individuals, so company data is “fair game”. Under POPIA that assumption is wrong from the first line of the Act:
“POPIA only protects individuals — company information is fair game.”
POPIA protects identifiable, existing juristic persons too. Companies, close corporations and trusts are data subjects; their information is personal information; and they hold the same rights of access, correction, objection and complaint.
“’personal information’ means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person...”
What this means for B2B data in practice
Your supplier database, your B2B prospect list, your tenant company records — all regulated personal information. In practice this changes less than the myth-makers fear and more than the cavalier assume. It changes little because the same six lawful grounds carry ordinary B2B dealing: performing contracts with corporate counterparties, complying with FICA and tax law, and pursuing legitimate business interests. It changes a lot for the cavalier because a juristic person can object, demand access and correction, and complain to the Information Regulator — and because section 69’s electronic-marketing regime protects data subjects generally, which includes companies. Scraping a directory of company emails and blasting it is not made lawful by the targets being businesses.
The GDPR contrast
The GDPR protects natural persons only — its recitals say so expressly. POPIA went further, deliberately. For multinationals this is a recurring compliance gap: a GDPR-built privacy programme imported into South Africa will systematically miss juristic-person data subjects. The other differences that matter — grounds naming, transfer mechanics, breach clocks and fine structures — are compared on POPIA vs GDPR.
“’data subject’ means the person to whom personal information relates;”
Note — “Person” in turn means a natural or a juristic person — so wherever the Act says “data subject”, a company can stand in that position.