South Africa: South Africa's Privacy Laws Are Evolving, but Vulnerable People Are Being Left Behind

What the report says

In an analysis published by The Conversation Africa and carried by AllAfrica, researcher Phumezo Ntlatywa argues that South Africa’s privacy protections are improving, but that the people most exposed to data misuse are not being adequately reflected in research, policy, or compliance efforts. The piece focuses on how routine digital activity — from banking and healthcare to community savings groups and messaging apps — can expose personal information when organisations or informal networks mishandle data.

The article says the risk is not evenly shared. Older adults, low-income communities, children, and people who depend on community organisations or small support networks may face greater harm because of limited digital literacy, fewer resources, and the sensitive nature of the information they share. Ntlatywa also notes that breaches involving health records or identity details can lead not only to fraud, but also to stigma and loss of dignity.

The analysis reviews South African privacy scholarship and finds that research has grown, especially since the Protection of Personal Information Act, or Popia, came into effect in stages from 2020 and 2021. It says earlier work centered on interpreting the law, while later research increasingly examined cybersecurity, compliance, and practical implementation. Popia is described as strengthening accountability and giving people more rights over their data.

Even so, the article argues that notable gaps remain: vulnerable groups, smaller organisations, rural areas, and social or behavioural questions about consent and trust are less studied than government and corporate settings. The broader significance, the piece suggests, is that privacy reforms may be less effective if they are not shaped around the circumstances of those most at risk.