Add to Preferred Sources
A popia data subject access request is a formal right under South Africa's Protection of Personal Information Act that entitles any individual to ask your business whether you hold their personal information — and to see it. The right comes from Section 23 of POPIA, part of South Africa's website compliance framework.
As a responsible party — the legal term for any organisation that processes personal information — you must respond. If your site collects a contact form submission, a newsletter sign-up, purchase history or any identifier that can be linked back to a person, a data subject can invoke these rights against you.
What makes this more pressing than most operators realise: the 2025 amendments to the POPIA Regulations, which took effect on 17 April 2025, widened the channels through which a person can submit a request to include WhatsApp, SMS and phone calls — all at no charge to the data subject. Your customer, employee or website visitor can now send you a WhatsApp message asking to see or delete their data, and you are legally required to act on it.
This guide covers the legal basis, which form applies to which request type, what the 2025 amendments changed, and the practical steps that put a compliant process in place — including what your website needs to support it.
Quick Answer
A popia data subject access request under Section 23 of POPIA allows any person to ask a business whether it holds their personal information and to access that record — free of charge for the confirmation step. Businesses must respond within a reasonable time and provide information in an understandable format. The April 2025 POPIA Regulation amendments (effective 17 April 2025) introduced expanded submission channels including WhatsApp and SMS, a 30-day notification deadline for correction and deletion request outcomes, and a requirement to electronically record telephonic requests. Non-compliance can trigger Information Regulator investigation and administrative fines of up to R10 million.
What's in this guide
Section 5: the nine data subject rights
How a Section 23 access request works
Which POPIA form applies to which request
What the 2025 amendments changed
Is your website set up for POPIA data subject requests?
Send us your current privacy policy and contact page — we will identify gaps in your data subject rights disclosures and show you what the 2025 rules require.
Get a Free ReviewWhat are the nine data subject rights under POPIA?
These are the data subject rights South Africa enforces through POPIA Section 5 — nine rights every person whose personal information you process holds against your business. A data subject who believes their rights have been violated can complain to the Information Regulator.
| Section 5 Right | What it requires of your business |
|---|---|
| Right to be notified | Inform individuals when you collect their personal information |
| Right to access | Respond to Section 23 access requests (this guide's focus) |
| Right to correction or deletion | Process Form 2 correction, deletion or destruction requests |
| Right to object to processing | Acknowledge Form 1 objections where the data subject has reasonable grounds |
| Right to opt out of direct marketing | Honour opt-outs under POPIA s69(3); do not resume sending after an opt-out |
| Protection from unsolicited electronic marketing | Do not send commercial email, SMS or WhatsApp messages without a lawful basis |
| Right against automated decision-making | Do not base significant decisions about a person solely on automated processing |
| Right to complain to the Regulator | Do not obstruct or discourage complaints to the Information Regulator |
| Right to civil legal action | Civil claims for interference with personal information are available to data subjects |
These rights operate alongside your obligations under POPIA's lawful processing conditions for marketing activities. A data subject exercising multiple rights — requesting access, then correction, then objecting to further processing — is not unusual; your process needs to handle each step separately.
How does a popia data subject access request work under Section 23?
Section 23 of POPIA gives a data subject, after they have provided adequate proof of identity, the right to ask your business to do three things.
Confirm whether you hold their personal information — and this confirmation must be provided free of charge. The data subject does not need to pay anything to establish that you have their data.
Provide the record or a description of it — including details of any third parties who have had access to that information. If you share customer data with a fulfilment partner or a marketing platform, you must be able to disclose that.
Provide the information in a reasonable time, in a reasonable format — specifically, "in a form that is generally understandable." A data export in raw JSON without explanation does not satisfy this obligation; an understandable summary does.
Confirmation Is Always Free — the Record May Carry a Fee
Section 23 draws a clear line: confirming whether your business holds personal information about a data subject must always be free of charge. A prescribed fee may apply to providing the actual record. If you charge anything for the initial confirmation — even a small administrative charge — that practice does not comply with POPIA.
When you disclose information in response to an access request, Section 23 requires that you notify the data subject of their right under Section 24 to request correction of anything inaccurate. This is not optional — it is part of the obligation that comes with a disclosure.
POPIA Section 23 vs PAIA records: A data subject using Section 23 can only request access to their own personal information. If someone wants access to records that are not about them — corporate documents, environmental records, contracts — they must use the Promotion of Access to Information Act process and your PAIA manual.
Many businesses conflate the two, but they are different legal processes with different forms and timelines. PAIA Form C is for general records access; Section 23 of POPIA is specifically for personal information. Direct each type of request through its correct channel.
A responsible party may also refuse to disclose information when PAIA grounds for refusal apply — for instance, where disclosure would harm a third party's privacy or where the information is legally privileged. Where only part of a record falls within a refusal ground, every other part must still be disclosed.
Which POPIA form applies to which type of request?
Three of the prescribed POPIA forms apply to data subject requests — and using the wrong one, or not recognising which POPIA access request form applies to which situation, delays compliance on both sides.
| Request type | Relevant section | Form | Submitted to |
|---|---|---|---|
| Access personal information held about them | Section 23 | No prescribed form — request by any convenient means with proof of identity | Your business (responsible party) |
| Object to processing of personal information | Section 11 | Form 1 (or substantially similar form) | Your business (responsible party) |
| Request correction, deletion or destruction of personal information | Section 24 | Form 2 (or substantially similar form) | Your business (responsible party) |
| Obtain or document consent for direct marketing | POPIA s69 / Regulation 6 | Form 4 (or substantially similar form) | Data subject — note: this form is sent by the responsible party to the data subject, reversing the direction of Forms 1 and 2 |
| Lodge a complaint about unlawful interference with personal information | Section 74 | Form 5 | Information Regulator |
Form 2 Is What Most Businesses Receive First
In practice, correction and deletion requests — Form 2 — arrive more often than access requests. After the 2025 amendments, these can come in by WhatsApp, SMS, email, phone or post. Build a log and response process that captures every channel, because "we didn't recognise it as a formal request" is not a valid reason to let one lapse.
After the April 2025 amendments, the forms can be "substantially similar" to the prescribed templates — meaning a well-worded email or WhatsApp message asking for deletion is legally equivalent to a filled-in Form 2. A data subject correction request POPIA regulations now accept in any substantially similar format — email, WhatsApp or verbal — no longer needs to arrive on a printed form; your operations team needs to recognise informal requests for what they are.
Form 5 — the complaint form — goes directly to the Information Regulator. A data subject uses Form 5 when they believe your business has violated their POPIA rights and they want the Regulator to investigate. This can happen if you ignore a Form 2 or fail to respond to a Section 23 access request. You can also find complaint details at inforegulator.org.za.
Does your team know how to identify an informal POPIA request?
We can review your internal process and show you where informal WhatsApp or email requests might be slipping through without a compliant response.
Check Your ProcessWhat did the April 2025 POPIA Regulation amendments change?
The amended POPIA Regulations took effect on 17 April 2025. Five changes are directly relevant to how your business handles data subject requests.
1. Expanded submission channels
Data subjects can now submit requests "by hand, fax, post, email, SMS, WhatsApp message or in any manner expedient to a data subject." This replaces what was, in practice, a much narrower set of accepted channels. Businesses that only published a postal address or a printed form are no longer compliant with how requests must be accepted.
2. Flexible form requirements
Forms 1, 2 and 4 may now be "substantially similar to" the prescribed templates rather than identical copies. A data subject who writes their own correction request email has met the Form 2 requirement if the content covers the same ground. This is better for data subjects but requires your staff to recognise requests that do not look like official forms.
3. Telephonic requests require recording
If a data subject submits a request by telephone or automated calling system, your business must electronically record that call and make the recording available to the data subject on request, at no charge. This is a new operational obligation many businesses have not yet built into their call-handling process.
4. 30-day notification deadline for correction and deletion outcomes
Once your business has determined the outcome of a correction, deletion or destruction request, you must notify the data subject of that outcome within 30 days. The clock runs from when the outcome is determined, not from when the request was received.
5. Submitting any request must be free of charge
There is no cost for a data subject to submit any request — whether an objection, a correction request, an access request or a complaint. If your current process charges any fee to initiate a request, that practice must be removed. Note: a prescribed fee may still apply when the actual record is provided in response to a Section 23 access request — the amendment removed the cost of submitting a request, not the cost of record delivery.
Compliant approach: A customer sends a WhatsApp message asking you to delete their personal information. Your information officer logs the request, sends an acknowledgement by the same channel, verifies identity by asking for their ID number, processes the deletion, and sends written notification of the completed outcome within 30 days. No charge to the customer for any step.
Non-compliant approach: You require customers to download a PDF form, print, sign and post it. Your policy states requests are only accepted by email. You charge any fee to process the request. All three of these practices — the mandatory printed form, the single accepted channel, the fee — are inconsistent with the 2025 amendments.
How must your business handle a data subject access request?
A documented response process is the operational backbone of POPIA compliance for data subject requests. Six steps cover the core obligations.
Step 1: Verify identity
Adequate proof of identity is required before any personal information is disclosed. An ID number, a copy of an identity document or another reasonable identifier is appropriate. Log the verification. Never disclose personal information before this step — giving another person's data to someone who has not proved their identity is itself a POPIA violation.
Step 2: Locate the information
Your registered information officer coordinates the search across all relevant systems — CRM, email platform, website database, accounting software, any third-party processors. The scope of your search must match what was asked for.
Step 3: Assess any grounds for refusal
POPIA allows refusal where PAIA grounds apply — for instance, protecting a third party's privacy, legally privileged communications, or information that could cause serious harm. If you refuse, document the specific ground in writing and disclose any part of the record that falls outside the refusal ground.
Step 4: Respond within a reasonable time
Section 23 sets the standard as "within a reasonable time." For a personal information access request South Africa businesses receive, using 30 days as a practical benchmark — consistent with the correction/deletion notification deadline introduced by the 2025 amendments — is advisable. A delay that cannot be justified by the complexity of the search is difficult to defend before the Regulator.
Step 5: Notify the data subject of their correction right
When you disclose information in response to an access request, you must advise the data subject of their Section 24 right to request correction of anything they believe is inaccurate, incomplete or misleading.
Step 6: Log the entire interaction
Record the date received, the channel, the identity verification outcome, the action taken, the outcome and the date of your notification. If the Information Regulator investigates, this log is your primary evidence of compliance. Without it, you have no way to show that a request was handled properly.
Your Information Officer Must Be Registered
Every responsible party must register its information officer with the Information Regulator before that officer can exercise their POPIA duties. The information officer handles incoming data subject requests, encourages internal compliance, and liaises with the Regulator during investigations. Registration is not a once-off filing — it is an ongoing obligation. Check the Regulator's portal to confirm your officer is registered.
What does your website need to support data subject request compliance?
Your website is where most data subjects will look first when they want to exercise their rights. If that visit ends in frustration because there is no clear contact point or process description, the next step for many people is Form 5 — a complaint to the Regulator.
The minimum your website compliance setup needs for DSAR support includes four elements.
A visible contact point for data subject requests — the name and contact details of your information officer, or a dedicated email address for data subject requests. This should not require a user to read through a lengthy privacy policy to find it.
A privacy policy that lists the nine Section 5 rights and explains how to exercise each one. It should state that requests can be submitted by email, WhatsApp, SMS or post, and that there is no charge for submitting a request. See the fuller requirements in our guide to SA privacy policy requirements.
A process description — how long it typically takes to respond, what identity verification is required, and what happens after a request is received. Data subjects should not have to guess.
A consistent channel offer — if your privacy policy says you accept requests by email only but the 2025 amendments require you to accept WhatsApp and SMS, the policy must be updated. Discrepancy between policy and practice is its own compliance risk.
What to include in your DSAR contact section: Name and contact details of your information officer · Email address dedicated to data subject requests · Statement that all requests are free of charge · Channels accepted (hand delivery, post, fax, email, SMS, WhatsApp) · Typical response timeframe · How identity will be verified before disclosure · How to escalate to the Information Regulator if unsatisfied (with a link to inforegulator.org.za)
A dedicated data subject request page is best practice for businesses that handle significant volumes of personal data. For smaller operations, a clearly written section within the privacy policy — with a prominent link from the website footer — meets the practical standard.
Why South African Businesses Work with Growth Pulse Media on Compliance-Ready Web Design
Growth Pulse Media builds POPIA compliance into your website's architecture from the start — not as a retrofit when a complaint forces the issue. Founder Dirk van Greuning scaled a South African ecommerce business before founding the agency, which means the operational weight of data subject obligations is familiar ground: the contact page structure, the way request channels are presented, how privacy disclosures surface in the user's path through the site.
When a data subject lands on your website looking for how to exercise their rights, the answer needs to be immediate and clear. Our web design work for South African businesses builds that clarity into the site's structure from the start, rather than retrofitting it when a complaint forces the issue. That includes how forms capture and store data, how consent is presented, and how the information officer contact is exposed.
We work with a limited number of clients at a time — senior attention throughout, no handoffs to juniors on the detail that matters. All work is executed in-house. If you want an assessment of where your current site stands against the 2025 POPIA requirements, the first conversation is free.
Who This Is NOT For
Not for businesses with no personal information exposure. If your website is a brochure-only page with no contact forms, no analytics cookies and no customer accounts, your POPIA data subject request obligations are minimal — though publishing your information officer's contact details remains good practice.
Not for operators who believe a template paragraph is enough. POPIA compliance is a documented operational process, not a boilerplate clause. A data subject who receives a non-response, a refusal without grounds, or a charge for submitting a request can file Form 5 with the Information Regulator. The Regulator has demonstrated it will act: the Department of Justice and Constitutional Development received a R5 million administrative fine for non-compliance with an enforcement notice.
Not for businesses that assume size creates an exemption. POPIA applies to any responsible party that processes personal information in South Africa — a sole-proprietor ecommerce store, a professional services firm with ten staff, and a listed company are all responsible parties. There is no SME carve-out for data subject access rights.
Not for businesses that skip identity verification before disclosure. Releasing personal information to someone who has not proved they are the data subject is itself a POPIA violation. The person whose data was wrongly disclosed can raise a separate complaint. Identity verification before disclosure is not optional — it is protection for both the data subject and your business.
Want a clear picture of where your POPIA process stands?
We'll review your website's privacy disclosures, contact architecture and data handling against the 2025 amendments — and show you exactly what needs updating before a request arrives.
Request a Compliance AuditFrequently Asked Questions
What must a business do when it receives a popia data subject access request?
A business must first verify the data subject's identity, then locate the personal information requested, and provide access to it within a reasonable time. Confirming whether the business holds personal information must be done free of charge; a prescribed fee may apply only when providing the actual record. The data subject must also be advised of their Section 24 right to request correction of anything inaccurate. Log every step — identity verification, action taken, outcome and date of notification.
Can a data subject submit a POPIA request via WhatsApp?
Yes. The April 2025 amendments to the POPIA Regulations (effective 17 April 2025) explicitly include WhatsApp, SMS, email, fax, post and any other method convenient to the data subject as valid submission channels. If a request arrives by phone, the call must be electronically recorded and that recording made available to the data subject on request, at no charge. A business that accepts only emailed or posted requests is not compliant with the amended regulations.
How long does a business have to respond to a data subject access request?
Section 23 of POPIA sets the standard as "within a reasonable time" for access requests. The 2025 amendments introduced a specific 30-day window for notification of correction and deletion outcomes — once the outcome is determined, the data subject must be notified within 30 days. Using 30 days as a practical benchmark for access requests is advisable, as delays beyond this are difficult to justify to the Information Regulator.
What is the difference between POPIA Form 1, Form 2 and Form 5?
Form 1 is used by a data subject to object to the processing of their personal information (submitted to the responsible party). Form 2 is for requesting correction, deletion or destruction of personal information (also submitted to the responsible party). Form 5 is the complaint form submitted directly to the Information Regulator when a data subject believes a responsible party has violated their POPIA rights. After the 2025 amendments, Forms 1, 2 and 4 may be "substantially similar" to the prescribed templates — so an email or WhatsApp message covering the same content as Forms 1 or 2 is legally valid. Form 4 is the direct marketing consent form sent by the responsible party to the data subject; it is not submitted to the business by the data subject.
What penalties apply if a business ignores a data subject access request?
Ignoring a data subject access request typically leads to a complaint to the Information Regulator, which can investigate and issue an enforcement notice. Non-compliance with an enforcement notice can result in an administrative fine of up to R10 million. Obstructing the Regulator or wilfully failing to comply with enforcement notices carries criminal penalties — a fine, up to 10 years' imprisonment, or both. The Department of Justice and Constitutional Development was fined R5 million for non-compliance with an enforcement notice, demonstrating that the Regulator enforces these powers.
Does POPIA apply to small businesses in South Africa?
Yes. POPIA applies to any responsible party that processes personal information in South Africa, regardless of business size. There is no statutory exemption for small or medium enterprises when it comes to data subject access rights. If your business collects customer emails, stores contact form submissions or processes any other personal information, you are a responsible party with data subject obligations.
Build a POPIA-Compliant Website That Protects Your Business
Growth Pulse Media designs websites for South African businesses that take POPIA compliance seriously — from privacy policy structure to data subject contact architecture. All work is done in-house, on a limited client load, with senior attention from brief to launch.
No obligation — we will get back to you within 24 hours.
Talk to Us About Your Website