Data Processing Agreement in South Africa: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) in South Africa governs how one party handles personal information on behalf of another. The governing statute is the Protection of Personal Information Act 4 of 2013 (POPIA). POPIA does not use the controller and processor labels familiar from Europe. The party that decides why and how personal information is processed is the responsible party. A party that processes personal information for the responsible party under a contract or mandate, without coming under its direct authority, is the operator. The DPA is the contract that sets the operator's duties. POPIA makes a written agreement effectively necessary. The responsible party must, in terms of a written contract, ensure the operator keeps personal information secure. This guide explains the framework, lists the clauses a South African DPA should contain, and gives a skeleton you can adapt. It is general information, not legal advice. Confirm the current position with a qualified South African lawyer before you sign. ## The law that governs data processing in South Africa - POPIA, roles. The responsible party determines the purpose and means of processing. The operator processes on its behalf under a contract or mandate.

• Section 19, security safeguards. The responsible party must secure the integrity and confidentiality of personal information through appropriate technical and organisational measures.
• Section 20, operator authority. An operator may process personal information only with the knowledge or authorisation of the responsible party, and must treat it as confidential.
• Section 21, written contract. The responsible party must have a written contract requiring the operator to maintain the security measures in section 19, and the operator must notify the responsible party where it has reasonable grounds to believe personal information has been accessed by an unauthorised person.
• Section 22, breach notification. Where there are reasonable grounds to believe personal information has been compromised, the responsible party must notify the Information Regulator and the affected data subjects.
• Section 72, cross-border transfers. Transfers of personal information outside South Africa are allowed only where a condition is met, such as adequate protection at the destination, the data subject's consent, or that the transfer is necessary for the contract. ## Key clauses in a South African DPA ### 1. Roles and subject matter Identify the responsible party and operator, and describe the processing: nature, purpose, duration, categories of personal information, and data subjects. ### 2. Scope and instructions Require the operator to process only with the responsible party's knowledge or authorisation and only for the agreed purposes. ### 3. Security safeguards (section 19) Set the technical and organisational measures the operator must maintain, including encryption, access control, and confidentiality undertakings. ### 4. Sub-operators Require prior approval of sub-operators and flow-down of equivalent obligations. ### 5. Breach notification (sections 21 and 22) Require the operator to notify the responsible party promptly where it believes information has been accessed without authority, so the responsible party can meet its section 22 duties to the Regulator and data subjects. ### 6. Cross-border transfers (section 72) Address whether processing or storage will occur outside South Africa and record the section 72 basis relied on. ### 7. Data subject requests Require the operator to assist the responsible party in responding to access, correction, and deletion requests. ### 8. Return or deletion On termination, require the operator to return or securely delete personal information and certify deletion. ### 9. Audit and assurance Give the responsible party a right to verify compliance. ### 10. Liability and term Allocate responsibility for breaches and align the term with the main contract. ## A simple clause skeleton 1. Parties and definitions

2. Roles (responsible party and operator)
3. Description of processing
4. Scope and instructions
5. Security safeguards (section 19)
6. Sub-operators
7. Breach notification (sections 21 and 22)
8. Cross-border transfers (section 72)
9. Assistance with data subject requests
10. Return or deletion
11. Audit and assurance
12. Liability, term and termination ## One workspace to draft, review and track the agreement A DPA is only as good as its current version. Sub-operator lists change, storage locations move, and POPIA breach timelines are short, so the live agreement and its obligations have to be easy to find. Spread across email and folders, they are easy to lose. Adira is an AI legal operating system that keeps drafting, review, clause-level editing, version history, and key-date tracking in one workspace, so the current DPA, its obligations, and its dates all live in one place. Indian data and corporate law is deepest today, and wider non-India jurisdiction depth, including South Africa, is on the roadmap, so treat this page as general guidance and verify South African specifics locally. You can see the product at Adira. ## Frequently asked questions