Rights Guide

How to Lodge a POPIA Complaint in South Africa

Data misused, shared without consent, or not secured properly? File a free complaint with the Information Regulator. Fines up to R10 million. Here's exactly what to do.

Free South African Law 3 related guides

Direct Answer

Lodge your POPIA complaint with the Information Regulator by emailing complaints.IR@justice.gov.za or completing Form 5 on the Information Regulator website. The Regulator has 90 days to investigate and must inform you of the outcome. This service is free.

What the Law Says

Your Legal Foundation

Protection of Personal Information Act 4 of 2013 (POPIA)

Section 74

“A data subject or any person may submit a complaint to the Regulator alleging that a responsible party has contravened any provision of this Act.”

POPIA

Section 11

“Personal information may only be processed if the data subject or a competent person where the data subject is a child consents to the processing.”

Constitution of South Africa

Section 14

“Everyone has the right to privacy, which includes the right to have the privacy of their communications respected.”

What to Do

Step-by-Step Guide

1Identify the POPIA violation. Common violations include: processing your information without consent, sharing your data with third parties, sending unsolicited marketing, failing to secure your data after a breach, and refusing your access request.
2Try to resolve it with the responsible party first. Contact the company or person and demand they stop processing your information, delete it, or address the breach. Put this in writing. Give them 30 days to respond.
3If unresolved, complete Form 5 — available on the Information Regulator website (inforegulator.org.za). Include: your details, the responsible party's details, a description of the contravention, and what you want done.
4Submit by email to complaints.IR@justice.gov.za or by post to the Information Regulator's offices.
5The Regulator has 90 days to investigate and must inform you of the outcome. They can issue enforcement notices, fines of up to R10 million, and refer matters for criminal prosecution.

What to Say

Exact Words to Use

“"In terms of POPIA, I am requesting that you immediately cease processing my personal information and delete all records you hold on me. Please confirm in writing within 30 days. If I do not receive a satisfactory response, I will lodge a complaint with the Information Regulator."”

Tone: Written, to the responsible party

Now practise saying it. The Advocate has a scenario that walks you through exactly this situation — phrase by phrase, with audio playback and a practice drill. Free to try.

Practise this scenario →

Common Questions

Frequently Asked Questions

What personal information does POPIA protect?

POPIA protects "personal information" — any information that identifies or can identify a person. This includes your name, ID number, contact details, biometric information, financial information, location, online identifiers, health information, and opinions about you.

Can I get my data deleted under POPIA?

Yes. Section 24 of POPIA gives you the right to request correction, deletion, or destruction of your personal information. The responsible party must respond to your request within a reasonable time. If they refuse, you can complain to the Information Regulator.

Does POPIA apply to individuals, not just companies?

POPIA applies to any "responsible party" that processes personal information — including individuals, companies, government entities, and non-profit organisations. If an individual shares your personal information without consent (e.g., sharing intimate photos), POPIA may apply alongside other laws such as the Cybercrimes Act.

Get Help Now

Resources & Helplines

Information Regulator

inforegulator.org.za

Lodge Form 5 complaints. Email: complaints.IR@justice.gov.za
Information Regulator Helpline

010 023 5207

General enquiries about POPIA rights.

Continue Learning

Practice Exactly What to Say

Filing a complaint is one thing. Knowing what to say directly to the person who misused your data — before you escalate — is another. This scenario trains you to invoke your POPIA rights in the moment, with audio and a drill. Free to try.

Practise your POPIA response — free →

No credit card needed · Know Your Rights. Know Your Word.

Get the free rights checklist

10 scenarios, exact words to use, constitutional references. No credit card.