For POPIA to apply, the Responsible Party (the person or company that determines the purpose and means for processing) must be domiciled in South Africa, or make use of “means” (equipment, like servers, etc) located in South Africa, unless those means are only used to “forward” personal information.

Remember: processing information in “the cloud”, on servers stored outside of South Africa, does not discharge you of the need to comply with POPIA.

POPIA Definition

(1) This Act applies to the processing of personal information—
(b) where the responsible party is—

  • (i) domiciled in the Republic; or
  • (ii) not domiciled in the Republic, but makes use of automated or non-automated means in the Republic, unless those means are used only to forward personal information through the Republic.
POPIA The Protection Of Personal Information Act