A former employee asks for the personal information the company holds about her.
A customer says his contact details are wrong. A supplier asks to stop receiving marketing. An applicant challenges information held in a recruitment system.
These are not unusual legal events.
They are ordinary business interactions that can exercise rights under POPIA.
People should be able to understand what you hold about them, access it where applicable, challenge it when it is wrong, object where POPIA permits and exercise the other rights the Act gives them.
Your processing inventory or ROPA helps identify where the requested information is held.
Your operator-governance process should help when relevant information is held by an external provider.
Your broader POPIA compliance framework should establish accountability for receiving, escalating, responding to and evidencing requests.
A privacy-rights process should not depend on one person remembering the law. The business should know how to recognise, route, fulfil and evidence the request.
Turning POPIA rights into a workable business process
What rights do data subjects have under POPIA?
Section 5 provides an overview of the rights available to data subjects under POPIA.
These include rights relating to notification, access, correction or deletion, objection, direct marketing, certain automated decisions, complaints to the Information Regulator and civil proceedings.
An important South African distinction is that POPIA is not limited only to natural persons.
A data subject is the person to whom personal information relates, and POPIA defines a person as a natural person or a juristic person. The definition of personal information expressly extends, where applicable, to an identifiable existing juristic person.
Can a person ask what personal information you hold?
Yes.
Under section 23, a data subject who provides adequate proof of identity has the right to ask a responsible party to confirm, free of charge, whether it holds personal information about that data subject.
The data subject may also request the record or a description of the personal information held, including information about the identity of all third parties, or categories of third parties, who have or have had access to the information.
Section 23 requires that access to that information be provided within a reasonable time, at a prescribed fee if any, in a reasonable manner and format, and in a form that is generally understandable.
Section 25 also applies sections 18 and 53 of PAIA to requests made under section 23.
This means SMMEs should understand that POPIA access requests and the PAIA access framework interact with one another.
When can personal information be corrected or deleted?
Section 24 gives a data subject the right, in the prescribed manner, to request correction or deletion of personal information in the responsible party's possession or under its control where the information is:
A data subject may also request destruction or deletion of a record of personal information that the responsible party is no longer authorised to retain under section 14.
This does not mean that every deletion request must automatically result in immediate deletion.
The organisation must consider the request against the actual section 24 and section 14 requirements and any lawful retention basis that remains applicable.
Section 24 requires these steps to be taken as soon as reasonably practicable.
The responsible party must also notify the data subject of the action taken.
Where a change to the information affects decisions that have been or will be taken about the data subject, the responsible party must, if reasonably practicable, inform the persons, bodies or responsible parties to whom that information was disclosed of the steps taken.
When can a data subject object to processing?
POPIA does not provide one universal right to object to every processing activity.
Section 11(3)(a) allows a data subject to object, at any time, in the prescribed manner and on reasonable grounds relating to his, her or its particular situation, to processing based on section 11(1)(d), (e) or (f), unless legislation provides for that processing.
Those grounds relate respectively to:
If a data subject validly objects under section 11(3), section 11(4) provides that the responsible party may no longer process the personal information.
What about withdrawing consent?
Where processing relies on consent under section 11(1)(a), section 11(2)(b) allows the data subject or competent person to withdraw that consent at any time.
The withdrawal does not retrospectively make earlier lawful processing unlawful. Nor does it prevent processing that is independently justified under another applicable basis in section 11(1)(b) to (f).
What rights apply to electronic direct marketing?
Section 69 deals specifically with direct marketing by means of unsolicited electronic communications, including email, SMS, fax and automatic calling machines.
The processing is prohibited unless the data subject:
The existing-customer route
A responsible party may market electronically to an existing customer under section 69(3) only where the statutory requirements are satisfied.
Section 69(2) also provides that where consent is required and the data subject has not previously withheld that consent, the responsible party may approach that data subject only once to request consent.
Current Regulation 6 allows the consent request through a form substantially similar to Form 4 or through accessible methods including email, telephone, SMS, WhatsApp, fax and automated calling, subject to the applicable recording requirements.
What rights apply to automated decisions?
Section 71 is narrower than a general prohibition on using automation or artificial intelligence.
Subject to its statutory exceptions, a data subject may not be subject to a decision that:
Section 71 gives examples of profiling relating to performance at work, creditworthiness, reliability, location, health, personal preferences or conduct.
Section 71 contains exceptions, including certain decisions connected with the conclusion or execution of a contract and decisions governed by a law or code of conduct where appropriate protections are provided.
Where the contractual exception relies on appropriate measures to protect the data subject's legitimate interests, those measures must include an opportunity for the data subject to make representations and sufficient information about the underlying logic of the automated processing to enable those representations.
What if the data subject is not satisfied?
Section 5 includes the right to submit a complaint to the Information Regulator regarding an alleged interference with the protection of personal information.
Section 74 provides that any person may submit a complaint to the Regulator in the prescribed manner and form alleging interference with the protection of a data subject's personal information.
The Information Regulator currently publishes Form 5 for POPIA complaints.
Build one practical request-handling process
An SMME does not need a large privacy team to manage data-subject rights.
It does need a recognised route from request to response.
A former employee asks for the information you hold about her
The request arrives by email to HR.
HR should not assume it is merely an employee-relations query or simply forward the entire personnel file.
Could your business handle a request tomorrow?
POPIA data-subject rights: practical questions
Can a data subject ask whether we hold information about them?
Yes. Section 23 allows a data subject who provides adequate proof of identity to request, free of charge, confirmation of whether the responsible party holds personal information about that data subject.
Does every deletion request have to be granted?
No. Section 24 identifies the circumstances in which correction or deletion may be requested, including where information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or where the responsible party is no longer authorised to retain it under section 14.
Can a data subject withdraw consent?
Yes, where the processing relies on consent under section 11(1)(a). Withdrawal does not affect the lawfulness of processing before withdrawal or processing that is independently justified under another section 11 basis.
Can a person object to any processing they dislike?
Not automatically. Section 11(3) provides specific objection rights, including objections on reasonable grounds relating to the data subject's particular situation where processing relies on section 11(1)(d) to (f), subject to the statutory qualifications.
Can an existing customer always be marketed to?
No. Section 69(3) contains specific cumulative requirements for the existing-customer electronic-marketing route, including how the contact details were obtained, similarity of the products or services and opportunities to object.
Does POPIA prohibit AI decision-making?
No. Section 71 addresses a narrower category of decisions that have legal or substantially significant effects and are based solely on automated processing intended to profile the data subject, subject to the statutory exceptions and safeguards.
Does POPIA require a DSAR register?
POPIA does not prescribe a document with that name. A structured request register is a practical governance mechanism for coordinating, monitoring and evidencing the organisation's handling of privacy-rights requests.
Data-subject rights should be easy to recognise — and possible to fulfil
An SMME does not need a dedicated privacy call centre.
It needs clear accountability, employees who can recognise a request, visibility of where personal information is held, appropriate forms and procedures, and a practical record of how requests were handled.
That turns privacy rights from a legal concept into an operating business control.
Recognise the request. Find the information. Apply the right. Respond. Keep the evidence.
Make privacy rights operational. Not dependent on somebody remembering what to do.
The Provara Group POPIA Compliance Programme gives South African SMMEs a structured implementation pathway for data-subject request procedures, access and correction workflows, marketing controls, processing records, operator coordination, accountability and retained compliance evidence.
This guide has been reviewed for alignment, as at 4 September 2026, with the Protection of Personal Information Act 4 of 2013, including the definitions and data-subject rights in sections 1 and 5; consent, objection and lawful processing under section 11; data-subject participation under sections 23 to 25; direct marketing under section 69; automated decision-making under section 71; and complaints under section 74.
Section 23 gives a data subject, after providing adequate proof of identity, the right to request free confirmation of whether a responsible party holds personal information about that data subject and to request the relevant record or description of personal information, including information about third parties or categories of third parties who have or have had access, subject to the provisions of that section and applicable PAIA requirements.
Section 24 allows a data subject, in the prescribed manner, to request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or destruction or deletion of records the responsible party is no longer authorised to retain under section 14.
Section 11(3)(a) provides a right to object, on reasonable grounds relating to the data subject's particular situation, to processing under section 11(1)(d) to (f), unless legislation provides for the processing. Section 11(3)(b) separately addresses objections to direct marketing other than unsolicited electronic communications under section 69. Section 11(4) provides that, following an objection under subsection (3), the responsible party may no longer process the personal information.
Section 11(2)(b) allows withdrawal of consent relied upon under section 11(1)(a). The withdrawal does not affect the lawfulness of processing before withdrawal or processing independently permitted under section 11(1)(b) to (f).
Section 69 regulates direct marketing by means of unsolicited electronic communications. The existing-customer route in section 69(3) is subject to its cumulative statutory requirements and should not be treated as a general permission to market to anyone who has previously dealt with the organisation.
Section 71 does not prohibit automation generally. It regulates specified decisions that result in legal consequences or substantially affect a data subject and are based solely on automated processing intended to provide a profile, subject to the exceptions and protective measures in that section.
The amended Regulations relating to POPIA that took effect on 17 April 2025 updated the practical processes for objections, correction and deletion requests, and consent requests for unsolicited electronic direct marketing. References in this guide to Forms 1, 2 and 4 refer to the applicable POPIA forms unless expressly identified as PAIA forms.
References in this guide to a data-subject request register, workflow, request log, identity-verification process, search record, operator coordination record and response evidence describe practical governance approaches. They are not presented as statutory POPIA document names or prescribed formats unless expressly identified as such.
Depending on the request, additional requirements may arise under PAIA, applicable codes of conduct, employment law, consumer law, sector-specific legislation, court rules, contractual obligations or other laws.
Important: This article provides general compliance information and practical governance guidance. It is not legal advice, does not constitute a legal opinion and does not guarantee compliance. The correct response to a data-subject request depends on the nature of the request, the information involved, the applicable processing justification, relevant exemptions or refusal grounds and the organisation's particular circumstances.