POPIA vs PAIA
POPIA (Protection of Personal Information Act) and PAIA (Promotion of Access to Information Act) are complementary statutes with different purposes. POPIA limits what organisations can do with your data; PAIA gives you a sword to obtain records you need.
POPIA
Protection of Personal Information Act 4 of 2013 — regulates how personal information is collected, processed, stored, and shared by responsible parties (any organisation that processes personal data).
When it applies: Use POPIA when an organisation has misused, leaked, or improperly collected your personal information, or is refusing to delete or correct inaccurate data.
Law: Protection of Personal Information Act 4 of 2013.
Example: Your medical insurer sells your health data to third parties without your consent.
PAIA
Promotion of Access to Information Act 2 of 2000 — gives any person the right to request access to records held by a public or private body, subject to limited grounds for refusal.
When it applies: Use PAIA when you need to obtain documents or records that a government department or private company holds and is reluctant to share.
Law: Promotion of Access to Information Act 2 of 2000; Constitution s32.
Example: You want access to a municipality's environmental impact report for a proposed development near your home.
Key Differences at a Glance
| Aspect | POPIA | PAIA |
|---|
| Primary purpose |
Protect individuals from misuse of their personal information |
Enable access to information held by public and private bodies |
| Rights created |
Right to consent, correct, delete, and restrict processing of your data |
Right to request and receive records within 30 days |
| Enforcer |
Information Regulator (complaints, fines, prosecutions) |
Information Regulator; courts (if request refused) |
| Who is bound |
Any responsible party that processes personal information |
All public bodies; private bodies for records needed to protect rights |
| Penalties for breach |
Fines up to R10 million; criminal prosecution |
Failure to respond treated as refusal; court can compel disclosure |
| Deadline to enforce |
Complaint within reasonable time; civil claim within 3 years |
PAIA request response within 30 days; internal appeal within 60 days of refusal |
Frequently Asked Questions
Can I use PAIA to get my own personal information from a company?
POPIA is the primary tool for accessing your own personal data. You can request a company to provide all personal information they hold about you under section 23 of POPIA. PAIA can also be used but POPIA is more direct for personal data.
Can POPIA and PAIA conflict?
Yes. PAIA creates a right of access, while POPIA creates grounds to refuse disclosure (protecting third parties' personal information). The Information Regulator manages this tension — disclosure that would violate another person's POPIA rights can be refused.
Which Act applies to journalists seeking government information in South Africa?
Primarily PAIA — journalists (and the public) use PAIA requests to obtain government records. POPIA protections for individuals can limit what is disclosed, but PAIA has strong grounds supporting media access and the public interest.