Understanding POPIA: What It Means for Private Investigations in South Africa

The Protection of Personal Information Act 4 of 2013 (POPIA) came into full effect in South Africa on 1 July 2021, and it fundamentally changed how investigations must be conducted in this country.

In simple terms, POPIA governs how personal information about South African residents is collected, stored, used, and shared. For private investigators, this has direct and significant implications.

Before POPIA, the legal landscape around information gathering in investigations was guided primarily by common law privacy rights and PSIRA regulations. POPIA added a formal, comprehensive framework that applies to everyone who processes personal information — including investigators, their clients, and any third parties involved in a case.

What does POPIA mean in practice for an investigation?

First, information must be collected for a specific, lawful purpose. An investigation mandate must have a defined, legitimate objective. Gathering information about a person out of curiosity, spite, or for purposes unrelated to the stated mandate is not lawful.

Second, only the minimum necessary information may be collected. This principle of proportionality shapes how investigations are scoped. We do not collect personal information beyond what is required to address the specific matter.

Third, the information must be handled securely. Case files, photographs, reports, and communications must be stored with appropriate security measures. This is not just an ethical standard — it is a legal obligation.

Fourth, data subjects have rights. The person being investigated has rights under POPIA, including the right to know their information is being processed in certain circumstances. This is why investigative methodology matters — how evidence is gathered can affect both its admissibility and the investigator's legal compliance.

For clients, POPIA means you should choose an investigator who understands these obligations and operates within them. Evidence gathered in violation of POPIA is challengeable and may expose both investigator and client to legal risk.

ISS Investigations structures every mandate around POPIA compliance. It is not a bureaucratic requirement for us — it is good practice that protects our clients and the integrity of our findings.