411
WhatsApp Ordered to Comply with South Africa’s Privacy Law or Face R10 Million Fine
South Africa’s Information Regulator has formally instructed WhatsApp to align its privacy practices with the Protection of Personal Information Act (POPIA) after determining that the messaging platform breached multiple sections of the law.
An enforcement notice was served to WhatsApp in September 2024, although full details have only now been made public on the regulator’s website. WhatsApp was given 60 days to comply, failing which it could face a fine of up to R10 million, imprisonment of up to 10 years, or both.
Key Areas of Non-Compliance
The regulator found that WhatsApp’s Revised Privacy Policy lacked transparency and failed to meet several legal obligations under Sections 8, 9, 11, 13, 15, 17, and 19 of POPIA.
Some of the major issues include:
-
Section 8 & 9: WhatsApp must show that its privacy policy aligns with South Africa’s legal conditions for processing personal data, not just those applied in Europe.
-
Section 11: The platform forces users to accept terms without valid consent, rendering that consent legally invalid under POPIA.
-
Section 13: WhatsApp has failed to clearly explain the purpose of collecting certain types of personal data.
-
Section 15: It shares user data with third parties, including companies under Meta Platforms, for purposes not originally disclosed to users.
-
Section 17: WhatsApp does not maintain sufficient documentation of its data processing operations as required under South African law.
-
Section 19: The company failed to demonstrate that it has documented and robust information security policies in place.
“WhatsApp is essentially stating that it should be taken on its word that it has adequate safeguards in place without demonstrating this to the Regulator,” the enforcement notice reads.
What WhatsApp Must Do Next
The Information Regulator has ordered WhatsApp to:
-
Submit an updated privacy policy that meets POPIA standards;
-
Provide documentation of all data processing activities under PAIA;
-
Conduct and submit a Personal Information Impact Assessment;
-
Demonstrate clear, technical safeguards for data security;
-
Improve transparency by revising its user communications and FAQs.
As of now, the regulator has not confirmed whether WhatsApp complied within the November 2024 deadline. The platform’s response—or lack thereof—could determine whether legal action or fines will follow.
This case sets an important precedent for data privacy enforcement in South Africa and signals that global tech companies are not above local law. It also raises concerns about the unequal treatment of users in different countries, as WhatsApp’s European policy appears more protective than the one provided to South African users.
The Information Regulator has stated it will provide further updates once it receives clarity on WhatsApp’s compliance status.
{Source: My Broad Band}
Follow Joburg ETC on Facebook, Twitter , TikTok and Instagram
For more News in Johannesburg, visit joburgetc.com
