South Africa is poised to roll out a sweeping set of regulatory changes in 2026 that will reshape the country’s data protection landscape, tighten artificial‑intelligence oversight and introduce new cybersecurity standards for the financial sector.

Key Elements of the Reform Package

The proposed amendments build on last year’s amendments to the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act. Among the most notable changes:

  • Direct‑Marketing Consent: Organisations must now obtain explicit written consent before sending unsolicited electronic marketing. A copy of the consent record must be provided on request.
  • Expanded Complaint Rights: The Information Regulator will allow complaints from representatives and public‑interest actors, broadening the pool of protected data subjects.
  • Fine Negotiation Mechanism: Companies can negotiate instalment plans for administrative fines, with affordability assessed on a case‑by‑case basis.

AI Regulation Update

The Financial Sector Conduct Authority has published an AI report that calls for clearer governance of algorithmic decision‑making in banking. The government is expected to introduce sector‑specific licensing requirements for high‑impact AI systems by the end of 2026.

“We are moving from a code‑red, reactive stance to a regulated, proactive approach,” said Dr. Nthabiseng Moyo, head of South Africa’s Information Regulator. “The goal is to protect citizens while fostering innovation.”

Cybersecurity Standards for Finance

A joint cybersecurity standard for financial institutions has been drafted and will take effect in 2026. The new rules mandate comprehensive risk assessments, continuous monitoring of threat landscapes and mandatory incident‑reporting protocols.

Implications for Businesses

Companies operating in South Africa will need to review their data‑handling practices, update consent mechanisms and prepare for stricter audit regimes. Financial institutions, in particular, must align with the forthcoming standards or face penalties.