POPIA and Email Signatures (South Africa)

The Protection of Personal Information Act, known as POPIA, is South Africa's data protection law. It applies to organizations that process personal information in South Africa, and the Information Regulator has enforced it since July 2021. POPIA does not prescribe specific signature wording, but it affects signatures in two ways. First, the signature itself contains personal information about the employee, such as name, role, phone, and photo, so it should carry only what the role requires, and employees should be told how their details are used. Second, many South African organizations add a confidentiality and privacy notice to outbound email, stating that the message may contain personal information, should be deleted if received in error, and is processed in line with POPIA, often with a link to the organization's privacy policy or PAIA manual. Separately, South Africa's Companies Act requires companies to show their registered name and registration number on official notices and publications, which many companies apply to email. Tracking pixels and click tracking in signatures should be covered by the privacy policy, because tracked engagement data about identifiable people is personal information.