The POPIA Regulations were amended — here's what actually changed.
On 17 April 2025 the Information Regulator gazetted amended POPIA Regulations (GN 6126), effective immediately. This is a summary, not the statutory text — always confirm against the official gazette before relying on it.
Objecting to processing (Reg 2)
Data subjects can now object free of charge through more channels — by hand, fax, post, email, SMS, WhatsApp, or phone. Organisations must inform subjects of this right at the point of collection, and must record/document telephonic objections.
Correction/deletion requests (Reg 3)
Same multi-channel widening as objections, with a 30-day response requirement.
Information Officer duties (Reg 4)
The requirement to maintain a standalone PAIA manual was removed (PAIA now governs that separately) — replaced with a duty to “continually improve” the compliance framework, not just maintain static documentation.
Direct marketing consent (Reg 6)
Written consent can now be given via “reasonably accessible” channels (email, SMS, WhatsApp, phone, fax). Telephonic/automated consent calls must be recorded, with transcripts available to the data subject on request. The Regulations now explicitly state that opt-out or non-response does not constitute consent.
Complaints procedure (Reg 7)
Widened who may lodge a complaint (including on behalf of others, or in the public interest) and the channels for doing so. The Regulator must now acknowledge receipt and issue a reference number within 14 days.
Forms
Forms 17–19 (from the 2018 Regulations) were deleted; Forms 1–5 were updated.
Administrative fines (Reg 13)
New provision allowing the Regulator to negotiate instalment payment plans for fines, assessed case by case against the responsible party's financial circumstances.
PopiGuard's Compliance Calendar and Task Manager are updated to reflect the 2025 Regulations — your estate's obligations, not just the raw gazette text.