What this page covers
POPIA governs what a financial provider may do with your personal information. It sits alongside FICA, which requires them to collect and keep much of it, and the two are often assumed to conflict when they do not.
| Condition | Meaning |
|---|---|
| Accountability | The responsible party must comply, not just intend to |
| Processing limitation | Collect only what is necessary, with a lawful basis |
| Purpose specification | Collect for a stated purpose |
| Further processing limitation | Do not reuse it for something unrelated |
| Information quality | Keep it accurate and current |
| Openness | Tell the person what you hold and why |
| Security safeguards | Protect it, and report breaches |
| Data subject participation | Let the person see and correct it |
| Right | How to use it |
|---|---|
| Be told what is held | Request access from the information officer |
| Correct or delete | Request correction of inaccurate data |
| Object to processing | Where the basis is legitimate interest |
| Opt out of direct marketing | At any time, free of charge |
| Complain | To the Information Regulator |
| Compensation | Through a civil claim |
| Situation | Which applies |
|---|---|
| A broker must keep your ID for five years | FICA requires it, POPIA permits it |
| A broker wants to market to you | POPIA, consent required |
| You ask for your data to be deleted | FICA retention overrides during the period |
| A breach exposes client records | POPIA, report to the Regulator and the people affected |
| Sharing data with a group company abroad | POPIA, cross-border transfer rules apply |
Download this data
Every table on this page as a spreadsheet, with the source and the date it was checked in the header rows.
⬇ Download CSVHow these figures work
The figures on this page come from the body that publishes them and change on a schedule rather than continuously, which is what makes them worth keeping in one place. A broker cannot delete your verification records on request while FICA still requires them. That is not a refusal of your rights, it is a competing statutory obligation.
Penalties under POPIA run to a fine of up to R10 million or imprisonment, and the Information Regulator has begun enforcing rather than only advising.
★ What this means in practice
Direct marketing by electronic means needs consent, and that consent may be requested only once.
✕ Common mistakes
- A broker cannot delete your verification records on request while FICA s. A broker cannot delete your verification records on request while FICA still requires them. That is not a refusal of your rights, it is a competing statutory obligation.
- Penalties under POPIA run to a fine of up to R10 million or imprisonment. Penalties under POPIA run to a fine of up to R10 million or imprisonment, and the Information Regulator has begun enforcing rather than only advising.
- Direct marketing by electronic means needs consent, and that consent may. Direct marketing by electronic means needs consent, and that consent may be requested only once.
- Taking a figure without its date. A number from a reference page is only as good as when it was last checked, which is why the date sits at the top of this one.
Notes on reading these figures
- A broker cannot delete your verification records on request while FICA still requires them. That is not a refusal of your rights, it is a competing statutory obligation.
- Penalties under POPIA run to a fine of up to R10 million or imprisonment, and the Information Regulator has begun enforcing rather than only advising.
- Direct marketing by electronic means needs consent, and that consent may be requested only once.
To put these figures to work, The FICA Requirements Reference runs the arithmetic on your own numbers; South African Financial Laws covers the same ground in ordinary language; How to Verify an FSP Licence goes into the detail this table only summarises; The Information Regulator is the related figure worth reading beside it; and Prudential Authority Reference covers what this page leaves out.
Put this table on your own site
The table below can sit on your own page and stays current without you editing anything.
- Preview the embeddable table as it will appear on your site
Add the code below to your own site. The table it renders is served from here, so it never goes stale.
<iframe src="https://www.tradeanswers.co.za/embed/ref-popia-for-financial-services.html" width="100%" height="620" style="border:0" title="POPIA for Financial Services"></iframe>Free to use with attribution. The link back to this page is built into the embed.
Terms used on this page
Frequently asked questions
Can I make a broker delete my data?
Not while FICA still requires it to be kept. That is a competing statutory obligation, not a refusal of your rights.
What rights do I have?
To be told what is held, to correct it, to object to some processing, to opt out of marketing, and to complain to the Information Regulator.
What are the penalties?
Up to R10 million, and imprisonment for some offences. The Regulator has moved from advising to enforcing.
Can a broker market to me?
Electronic direct marketing needs consent, and that consent may be requested only once.
Who is the information officer?
The person at the organisation accountable for POPIA compliance. Every responsible party must have one.
Can my data be sent abroad?
Only under the cross-border transfer rules, which require comparable protection in the destination.