Living in the information age, data has commonly been considered a valuable asset. To avoid the exploitation of information at the expense of individuals the Protection of Personal Information Act 4 of 2013 (‘‘POPIA’’) was enacted. Although the POPIA was signed into law in 2013, only a few limited sections pertaining to the Act’s definitions, the Information Regulator, and the Regulations are in force. In preparation for the commencement of POPIA, it is imperative that all parties affected are aware of their rights and obligations. POPIA regulates South African institutions and the manner in which they collect, store, process, disseminate, and delete information. For purposes of POPIA, a responsible party refers to any body or person who determines the purpose of, and methods for, processing personal information and a data subject refers to the person to whom personal information relates.