Regulationsby GlyphSouth Africa Cybercrimes Act
In force South Africa · In force Dec 1, 2021 · no upcoming deadlines
Deadlines
Most of the Act commencesCommenced by proclamation in Gazette 45562 of 30 November 2021, excluding Part VI of Chapter 2, some Chapter 4 sections and section 54.
Summaries for reference, not legal advice. Check the official text.
What it does
Creates cybercrime offences such as unlawful access, interception, interference with data and systems, cyber fraud, extortion, and malicious communications including harmful intimate images. It also sets rules for search, seizure and cross-border cooperation. The duty for electronic communications service providers and financial institutions to report cybercrime (section 54) has not yet commenced.
- Who it applies to
- Everyone in South Africa; electronic communications service providers and financial institutions have specific duties once section 54 commences.
- Penalties
- Criminal fines and prison terms set per offence, up to 15 years for the most serious offences.
- Enforced by
- South African Police Service, National Prosecuting Authority and the courts
- Official name
- Cybercrimes Act 19 of 2020
- Citation
- Act 19 of 2020 (Gazette 44651)
- Topics
- Cybersecurity, Online safety, Breach notification
Verified 2026-09-25 gov.za
Research notes
enacted_date is the Gazette publication date (1 June 2021). Section 54 reporting (72 hours) has no commencement date yet.
Related
Egypt PDPLEgypt's data protection law covers personal data processed electronically. It sets consent and lawful processing rules, strict rules for sensitive data and cross-border transfers, and a licensing and permit system run by the Personal Data Protection Center. The Executive Regulations were only issued in November 2025, which starts a one-year window to comply.Next: Nov 2 One-year compliance window ends · in 6 days
Israel Privacy Protection Law Amendment 13Major overhaul of Israel's privacy law: broadens definitions (personal and highly sensitive information), narrows database registration, requires privacy protection officers for certain entities, and gives the Privacy Protection Authority powers to impose large administrative fines and orders, plus statutory damages.In effect since Aug 14, 2025
Kenya Computer Misuse and Cybercrimes ActKenya's main cybercrime law. It creates offences such as unauthorised access, interference, cyber harassment and false publication, sets up a National Computer and Cybercrimes Co-ordination Committee, and requires critical infrastructure owners to report threatening incidents. The 2025 amendment adds identity theft rules and lets the Committee order websites or apps that promote unlawful activity, child sexual content, terrorism or extremism to be blocked.In effect since May 30, 2018Kenya Data Protection ActKenya's GDPR-inspired data protection law establishing the ODPC, mandatory registration of data controllers and processors, data subject rights, 72-hour breach notification to the Commissioner, DPIAs, and conditions on cross-border transfers (with some data localisation for strategic public interest processing).In effect since Nov 25, 2019
Nigeria NDPANigeria's primary data protection statute, establishing the NDPC, lawful bases, data subject rights, 72-hour breach notification, and special duties for data controllers and processors of major importance (registration, DPO, compliance audits). The GAID 2025 supersedes the NDPR 2019 and its Implementation Framework with detailed rules on audits, DPIAs, transfers and more.In effect since Jun 12, 2023Rwanda DPP LawRwanda's data protection law, modelled on the GDPR. Controllers and processors must register with the supervisory authority, report breaches within 72 hours, and store personal data in Rwanda unless they hold a certificate allowing storage abroad. Cross-border transfers need authorisation or another listed ground.In effect since Oct 15, 2021
Saudi PDPLSaudi Arabia's comprehensive data protection law with implementing regulations and separate transfer regulations: legal bases, data subject rights, breach notification to SDAIA within 72 hours, DPO and registration requirements, and restrictions on transfers outside the Kingdom.In effect since Sep 14, 2023
South Africa POPIASouth Africa's comprehensive data protection law built on eight conditions for lawful processing, with Information Officer registration, security compromise notification to the Regulator and data subjects, and restrictions on direct marketing and cross-border transfers. Protects juristic persons as well as individuals.In effect since Jul 1, 2020
Questions about South Africa Cybercrimes Act
- What are the South Africa Cybercrimes Act compliance deadlines?
- Dec 1, 2021: Most of the Act commences.
- When does South Africa Cybercrimes Act take effect?
- South Africa Cybercrimes Act took effect on Dec 1, 2021.
- Who does South Africa Cybercrimes Act apply to?
- Everyone in South Africa; electronic communications service providers and financial institutions have specific duties once section 54 commences.
- What are the penalties under South Africa Cybercrimes Act?
- Criminal fines and prison terms set per offence, up to 15 years for the most serious offences.