The comparison, dimension by dimension
| Dimension | POPIA (South Africa) | GDPR (EU) |
|---|---|---|
| Who is protected | Natural persons AND identifiable, existing juristic persons — companies, CCs, trusts are data subjects | Natural persons only |
| Lawful grounds | Six grounds in s 11(1): consent, contract, legal obligation, data subject’s interest, public duty, legitimate interests | Six bases in art 6(1) — closely parallel; vital interests and public task framed differently |
| Special categories | Ss 26–33: includes criminal behaviour and trade union membership; sector authorisations (health s 32, race for EE/B-BBEE s 29) | Art 9 special categories + art 10 criminal data; derogations member-state specific |
| Responsible officer | Information officer exists in EVERY organisation by operation of law; registration with the Regulator compulsory (s 55(2)) | DPO required only for certain processors/activities (art 37) |
| Cross-border transfers | Five gateways in s 72; no adequacy list; binding agreement (e.g. provider DPA) suffices | Chapter V: adequacy decisions, SCCs, BCRs — a formal adequacy architecture |
| Breach notification | “As soon as reasonably possible” (s 22); eServices portal mandatory since 1 April 2025; NO materiality threshold | 72 hours to the authority unless unlikely to result in risk (art 33); data subjects only on high risk |
| Maximum fines | R10 million administrative fine cap (s 109(2)(c)); criminal offences listed separately | Up to €20m or 4% of global annual turnover, whichever is higher |
| Civil claims | Strict liability damages claim — no intent or negligence needed (s 99) | Art 82 compensation — fault-based with reversed burden |
| Direct marketing | S 69 opt-in for electronic; once-off consent ask; Regulator reads phone calls as electronic; opt-out for post/in person | GDPR + ePrivacy regime; soft opt-in similar; member-state variation |
| Prior authorisation | Four narrow triggers need once-off Regulator authorisation (s 57) | Prior consultation only for high-risk DPIAs (art 36) |
The scope difference is the one to memorise, and it is in the definition itself:
“’personal information’ means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person...”
Where imported GDPR programmes miss POPIA
Multinationals typically localise the EU playbook and call it done. The recurring gaps: juristic persons — supplier and B2B data flows nobody risk-assessed (see companies and B2B); the information officer — a registration duty with no GDPR equivalent, checked in enforcement (see information officers); breach reporting — the GDPR’s risk threshold does not exist here: all compromises, via the portal (see data breaches); marketing — the once-off consent ask, Form 4 mechanics, recorded calls and the phone-call question are POPIA-specific (see direct marketing); and civil exposure — section 99’s strict liability changes the breach-litigation calculus in South Africa.