The Information Regulator reflects on Popia, Paia and why data rights governance must blend legal and technical expertise.

TechCentral

South Africa's Information Regulator marks 10 years with mixed results on data rights. Popia (Protection of Personal Information Act) is considered strong legislation with high awareness among businesses and government, though public behavior hasn't changed much despite 49% awareness. Paia (Promotion of Access to Information Act) needs substantial reform, particularly around enforcement powers. The regulator faces capacity challenges due to limited resources and inability to compete with private sector salaries for technical talent, causing delays. Multi-agency cybersecurity coordination remains weak. The regulator is monitoring AI developments and advocates for privacy-by-design approaches, while emphasizing the need for more data scientists and technical specialists alongside legal experts to effectively regulate at the intersection of law and technology.

Popia is strong, Paia needs reform, says Information Regulator