Personal information privacy in South Africa: POPIA rights and clear requests

Identify the personal information and the privacy question

POPIA is the Protection of Personal Information Act 4 of 2013. Its definitions cover more than names: identifiable contact details, financial information, preferences and private correspondence can be personal information. Processing includes holding and using information, as well as collecting it.

Start with an identifiable item. ‘The postal address recorded in my profile’ is clearer than ‘my data is wrong’. ‘The purpose for keeping the attachment I supplied’ is different again. Naming the item gives the organisation something to locate and helps you distinguish a question about its accuracy from a question about its continued use.

Also identify whose information it is. Your own correspondence can mention another person, and a shared document can contain several people’s details. Do not assume that asking for your information establishes an entitlement to every other person’s information in the same record. Keep the requested subject visible throughout the enquiry.

Connect the purpose with proportionate collection

Sections 10 and 13 of POPIA address proportionate processing and a defined lawful purpose. Section 11 provides several possible grounds for processing; consent is not the only one. A missing consent box therefore does not, by itself, decide whether processing is lawful.

A useful question links the requested detail to its stated purpose: ‘What function requires this particular field?’ This invites an explanation that can be examined. Saying only ‘you may not ask me anything’ or ‘I clicked agree, so every later use is covered’ skips the relationship between the information and the activity it is meant to support.

Consider an invented form asking for several contact details. The issue is not simply how many boxes it contains. Ask which details serve which purpose, whether each is required and what happens if an optional field is left blank. These questions seek clarity without presuming that the collection is either justified or excessive before the explanation is available.

Read a privacy notice for the question you actually have

A privacy notice can connect the information collected with its purpose, the organisation responsible and the relevant contact route. Section 18 of POPIA addresses collection notifications, subject to exceptions. Reading a notice is a starting point for understanding the explanation, not proof that every actual practice complies with it.

Look for the paragraph that concerns your situation. A section about job applicants may not explain a customer record, and an explanation about website enquiries may not describe a separate account service. Match the activity and the entity named in the notice before applying its wording to your information.

Where the notice uses a broad expression such as ‘service purposes’, ask how that expression relates to the particular information you identified. You do not need to reproduce the entire document. A precise reference to the relevant paragraph and a clear question about its meaning make the enquiry easier to answer than a general request to explain every privacy practice at once.

Find the organisation and the information-request contact

The brand displayed on a page, a service provider involved in processing and the organisation responsible for a particular decision about information are not automatically the same thing. Identify the entity named in the relevant privacy information. Then look for its designated information-request route rather than assuming that every general enquiry channel performs the same task.

The Information Regulator’s guide to access to information explains Information Officers and the request process. Use the organisation’s current privacy information or PAIA manual to establish the appropriate contact and any applicable form. A manual explains an organisation’s access arrangements; it is not itself the personal information you are requesting.

If the recipient or procedure remains unclear, make that the first question: ‘Which contact handles a request concerning my personal information in this service?’ This article has not verified BravoBet’s current privacy contact, notice or submission process. A general example here should not be copied into a claim that the operator uses a particular channel.

Choose between explanation, access, correction and deletion

Different requests seek different outcomes. Asking why a field is required does not necessarily ask for a copy of its contents. Requesting a copy does not automatically ask for a correction. State which outcome you want instead of relying on the phrase ‘POPIA request’ to communicate the whole task.

The examples below are invented requests, not findings about an organisation’s records. They separate the immediate question from assumptions that might otherwise slip into it. You can combine related requests, but give each its own sentence so that the response can address them individually.

For example, you might first need to know whether an old address is still held, then request a correction if it is used as your current address. Those are connected questions. Keeping them distinct avoids demanding a change to an unidentified record or treating a confirmation of possession as confirmation that a correction has been made.

Scroll sideways to read the full table.

Understand what an access request asks for

Section 23 distinguishes free confirmation that personal information is held from access to its record or description, for which a prescribed fee may apply. Adequate proof of identity is required. The Regulator’s PAIA guide explains the access framework, including requests concerning a person’s own information under POPIA.

Describe the information sought in ordinary language. A request concerning contact details supplied during a stated period is more defined than ‘send all data everywhere’. A defined request is not an instruction to abandon a broader right: its purpose is to make the records you currently need identifiable. If you need wider coverage, state that coverage clearly instead of leaving the recipient to infer it.

Ask which form and process apply, what format is available and whether a charge is proposed. Do not assume that every request is free, that every possible record exists or that a fixed deadline found in an overseas article applies. Access can also be limited by applicable refusal grounds; an explanation of a limitation is different from a promise of unrestricted disclosure.

Request a specific correction rather than a general change

The Regulator’s amended POPIA regulations provide for correction or deletion requests concerning information that meets the specified grounds, including inaccuracy or being out of date. They describe a request substantially similar to POPIA Form 2, free of charge, with accessible submission methods. Check the current requirements rather than assuming only one delivery method is permitted.

In an invented example, an account profile still displays a former postal address. Identify the field, explain that it is no longer your current address and specify the replacement information through the applicable process. That is more precise than asking the organisation to ‘fix everything’. It also gives the reply a clear subject: the current profile entry.

Separate a present entry from a historical document. An old application may accurately record the address supplied at that time, even when it should no longer be treated as your current address. Explain which use or entry concerns you. A correction request should make the alleged problem understandable without assuming that the same change must be applied identically to every record.

Distinguish deletion from account closure and retention

Section 14 of POPIA limits retention while allowing specified grounds for keeping records. The amended regulations connect destruction or deletion requests to information the organisation is no longer authorised to retain. These provisions do not create an unconditional promise that an account-closure request immediately removes every record.

Ask which record remains, why it is retained and what determines the retention period. A statement that ‘we retain information’ leaves the purpose unclear; a statement about a particular category and its applicable basis is more informative. This guide assigns no retention period or statutory recordkeeping duty to BravoBet.

Likewise, a request to stop one use of information, a request to change current details and a request to delete a retained record are not interchangeable. Explain the outcome sought for the identified information. If the organisation says that some material must remain, ask which part that statement concerns rather than assuming that it answers every question about every use.

Write a request with an identifiable subject and outcome

A clear request can be organised around four elements: the information concerned, the relevant activity or period, the action requested and the point that needs an explanation. These elements are an editorial writing aid, not a substitute for an applicable prescribed form. Use them to make the content of that form or enquiry understandable.

For an invented correction request, the core might read: ‘The postal-address field in my current profile shows a previous address. Please consider correcting that current entry through your applicable process. Please tell me what information is needed to identify the entry and confirm the outcome.’ This example deliberately identifies no real person, account or replacement address.

For an access request, change the action rather than reusing correction wording: ‘I request access to the personal information about my contact preferences recorded during the period I identify.’ Then explain the period and desired format. Keep questions about why the information is used distinct from the request to see what is recorded.

You can express a bounded first request without saying that no other information matters. If an unfamiliar category appears in the response, a later question can identify it directly. Clarity comes from naming the current task, not from using the longest possible list of legal expressions.

Read the response against the action you requested

A receipt acknowledgement, an explanation of purpose, a copy of information and a correction outcome do different jobs. Read the reply beside the action requested. An answer can be useful while leaving part of the question unresolved; that is a reason to identify the remaining point precisely.

The hypothetical examples below show how to interpret a response without jumping to a conclusion about compliance. If the reply uses abbreviations or describes an unfamiliar record category, ask what those terms mean in relation to your information. A technical-looking export does not explain itself simply because it contains many fields.

Where access is limited, identify the information affected and the reason given. Do not assume that a partial response necessarily means nothing further can be disclosed, or that another person’s information must be included because it appears near your own. The relevant process and applicable limits determine the next question.

Scroll sideways to read the full table.

Use the appropriate Information Regulator route

The Information Regulator’s current complaints page distinguishes POPIA complaints from PAIA access complaints. It includes failures to respond to privacy-rights requests among its POPIA examples and directs users to register a profile and submit through its eServices portal. Consult that page for the current process and any applicable requirements rather than relying on a saved submission address.

Name the privacy issue accurately: an alleged inaccurate entry, an unexplained use or an unaddressed correction request is more precise than a general statement that an account service is unsatisfactory. A complaint about information handling is not automatically a request for an account decision to be reversed. Keep the privacy action sought visible.

Forms with the same number can also have different purposes. POPIA Form 2 concerns correction or deletion, while PAIA Form 2 concerns access to a record. Their titles and governing process matter. If an access decision is involved, check the PAIA route and applicable procedural steps, including any internal appeal where available, rather than assuming a generic privacy form completes every requirement.

Keep the privacy outcome clear and the guidance current

This guide uses the Act, the Regulator’s guidance and the amended regulations published for implementation by Government Notice 6126 of 17 April 2025. The sources were checked on 12 November 2026. Revisit current official instructions when making a request; an older article may describe forms or submission arrangements that have changed.

For the wider relationship between a brand and its public information, see the BravoBet South Africa guide. The separate South African terminology and licensing guide concerns a different question. Neither a brand introduction nor a regulatory category establishes an organisation’s particular privacy practices.

Protecting access to an account is also a distinct task, covered in the online account security guide. Here, the useful outcome is a clear answer about personal information: what is held, why it is used, which action was requested and what remains unresolved. Understanding those points helps you ask a precise question without claiming that every request must have the same result.