The amendments, effective from 17 April 2025, follow the Information Regulator’s (Regulator) introduction of an e-Portal to report security compromises online. As of 1 April 2025, the portal is deemed a mandatory reporting tool for both private and public organisations.

The amended regulations introduce definitions for “complaint” and “complainant”, aligning the term “complainant” with the language used in section 74(1) of POPIA. 

Other significant changes include:

The following are key takeaways for organisations:

• Mechanisms must be implemented to ensure that telephone conversations are easily recorded and accessible, particularly when a data subject requests the destruction and deletion of their personal information or objects to it being processed.
• Since opting out is not considered valid consent, as required by section 69(2) of POPIA, organisations must revise their internal procedures for obtaining consent from data subjects for direct marketing purposes through electronic communications.

PAIA manuals need to be updated to make provision for the new prescribed forms.