Deepfake Law in South Africa
South Africa regulates deepfakes through POPIA (data protection), the Cybercrimes Act 2021, and the Films and Publications Act. Dedicated deepfake legislation is under debate.
- Status
- enacted
- Jurisdiction
- South Africa
- Effective
- Dec 2021
- Statute
- POPIA 2013 + Cybercrimes Act 2020 + FPA amendments
South Africa's deepfake regulation relies primarily on POPIA (Protection of Personal Information Act), the 2020 Cybercrimes Act, and the Films and Publications Act. Dedicated deepfake legislation has been under debate but not enacted.
Key provisions
Cybercrimes Act 2020 (effective December 2021). Criminalizes:
- Unlawful interception, interference, or acquisition of data (broadly interpreted to include unauthorized use of biometric data for deepfake creation).
- Malicious communication — including deepfake content intended to cause harm.
Penalties up to three years imprisonment for most offenses; higher for aggravated cases.
POPIA (Protection of Personal Information Act 2013, effective 2021). Biometric data is explicitly protected as special personal information. Consent requirements apply to voice and facial feature use in synthetic content. Enforcement through the Information Regulator.
Films and Publications Act (amended). Includes provisions on non-consensual intimate imagery, applied to AI-generated content.
Electoral Code of Conduct. Covers false statements about candidates, applied to election-context deepfakes during the 2024 South African elections.
Information Regulator enforcement
The Information Regulator has been active on AI and data protection:
- Guidance on biometric data and AI use.
- Investigations into unauthorized facial-recognition deployments.
- Cross-border cooperation with peer African DPAs.
Practical implications
For organizations operating in South Africa:
- AI service providers: POPIA compliance essential; biometric-data provisions are strong.
- Platforms: Films and Publications Board cooperation expected on takedown orders.
- Enterprises: moderate compliance burden; South Africa is the most developed African jurisdiction on AI/data-protection regulation.