Khanyitas

POPIA Correction and Deletion Requests: What SA Businesses Need to Know

23 May 2026 · SA businesses receiving data subject requests

POPIA Correction and Deletion Requests: What SA Businesses Need to Know

When a customer, employee, or supplier asks you to fix or remove their personal information, that request carries legal weight under the Protection of Personal Information Act (POPIA). Understanding how these requests work — and what a business is expected to do with them — is an important part of running a compliant operation in South Africa.

> Disclaimer: This article is general information based on published Information Regulator guidance and the text of POPIA. It is not legal advice. For your specific situation, consult a qualified attorney.

---

What Is a Correction Request?

POPIA section 24 gives data subjects — the people whose personal information you hold — the right to request that you correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully. They may also request that you destroy or delete a record you are no longer authorised to retain.

In plain terms: if someone believes the information you hold about them is wrong or should not exist, section 24 gives them a formal route to challenge that.

Who Can Make a Request?

Any data subject whose personal information you process can submit a correction or deletion request. That includes:

There is no prescribed format in POPIA for how the request must be submitted, so businesses are advised to accept requests in writing (email is fine) and to document receipt clearly.

What Are Your Obligations Once a Request Arrives?

Section 24 sets out several things a responsible party (that is, your business) is expected to do once a correction or deletion request is received.

1. Correct or delete the information — or explain why you will not. If the information is indeed inaccurate, out of date, or should not be held, POPIA's framework contemplates that you correct or delete it as soon as reasonably practicable. If you believe the information is accurate and that you have a lawful basis to retain it, you are not automatically required to delete it — but you are expected to respond and explain your position.

2. Notify third parties where practicable. If you have shared the data subject's information with third parties, section 24 contemplates that you take reasonable steps to inform those third parties of the correction or deletion. Where third parties are difficult to identify or contact, document the steps you took.

3. Keep a record. POPIA's documentation requirements (see section 17, which covers records of processing activities) support the practice of keeping a log of data subject requests — when they were received, what action was taken, and when.

4. Respond within a reasonable time. POPIA does not specify a fixed number of days for responding to correction or deletion requests (unlike some international frameworks). The Information Regulator's general guidance emphasises that responses should be prompt. Many compliance practitioners recommend treating 30 days as a working benchmark, but your legal counsel can advise what is reasonable in your circumstances.

When Can You Decline a Deletion Request?

Not every deletion request must be honoured. There are situations where a business may have a lawful basis to retain personal information even after a data subject has asked for it to be removed.

Common examples include:

POPIA section 14 deals with the retention and restriction of records — including the requirement that personal information not be kept for longer than is necessary for the purpose for which it was collected. Reading sections 14 and 24 together gives a clearer picture of when retention is appropriate and when it is not.

Correction Requests vs. Deletion Requests: A Practical Distinction

| Request type | What the data subject wants | Typical response | |---|---|---| | Correction | Fix inaccurate or incomplete information | Update the record; notify third parties | | Deletion / destruction | Remove personal information entirely | Delete where no lawful retention basis exists; explain if declining |

Both types of request are governed by section 24, but the operational steps differ. A correction request is often simpler to handle — you update a field and confirm it is done. A deletion request may require you to locate copies of the data across multiple systems (CRM, email, backups, third-party processors) before you can certify that it has been removed.

Practical Steps for Building a Request-Handling Process

  1. Designate a point of contact. Your Information Officer (whose duties are set out in section 55 of POPIA) is the natural owner of data subject requests. Make sure staff know where to route incoming requests.
  2. Create an intake log. Record the date, the nature of the request, the data subject's identity (verified), and the action taken.
  3. Map your data. You cannot delete data you cannot find. A basic record of processing activities (section 17) helps you locate where a particular person's data lives.
  4. Draft template responses. Having pre-approved response letters — for acknowledgement, for action taken, and for declined requests — reduces delay and keeps your tone consistent.
  5. Train your team. Customer-facing staff should know to escalate a correction or deletion request rather than handling it ad hoc.

Where to Find Primary Guidance

---

> Disclaimer: This article is general information based on published Information Regulator guidance and the text of POPIA. It is not legal advice. For your specific situation — including whether a particular deletion request must be honoured or may be declined — consult a qualified attorney.