Imagine receiving a message from your bank about suspicious activity on your account, only to discover that someone has accessed your personal information after an organisation you trusted suffered a data breach. Or finding that your medical records or identity details have been exposed online without your knowledge. As more South Africans use digital services for banking, healthcare, education and social media, such incidents are becoming an increasing concern.
Privacy breaches involving personal information do not affect everyone equally. Some people are more vulnerable than others because of their social circumstances, limited digital literacy, economic dependence, or the sensitive nature of the information they share online.
People who may be disproportionately affected include older adults who are less familiar with digital technologies, low-income communities with limited access to digital literacy programmes and children whose personal information is often shared by parents, schools or caregivers. People who rely on community organisations or informal support networks can also face privacy risks.
For example, a stokvel (community-based saving group) may collect members’ identity numbers and banking details to manage contributions, while neighbourhood lift clubs often share names, phone numbers and locations through messaging apps. These are everyday activities that depend on trust, making the responsible handling of personal information especially important. If this information is mishandled or exposed, the consequences can be significant for those involved.
When personal health information is compromised, the consequences can extend far beyond fraud or identity theft. People could be exposed to stigma, discrimination and loss of dignity.
I am a researcher whose work focuses on privacy and social media use in South Africa, particularly how people and communities share sensitive information online. In a recent study, I analysed published South African research on privacy and data protection to understand what scholars are studying, and what may be receiving less attention.
I found encouraging growth in this research in South Africa. Much of the work has focused on areas such as legal rules, cybersecurity measures that protect systems from attacks and organisational practices that help institutions handle information responsibly.
But important blind spots remain. Vulnerable groups receive limited attention in the research. The same is true for community structures such as non-profit organisations, civil society groups, community-based organisations and small enterprises. These institutions regularly handle sensitive personal information with limited resources, little compliance support and low public awareness of privacy risks.
This matters because research often shapes public discussion, policy priorities and awareness programmes. If vulnerable communities receive little attention in research, the challenges they face may also receive less visibility in efforts to improve privacy protection. Solutions won’t be reached with them in mind.
How privacy research changed after legislation
South Africa has legislation in place to protect sensitive information such as children’s data, health records and religious beliefs. The Protection of Personal Information Act (known as Popia) introduced major compliance requirements from July 2020, with full enforcement beginning in July 2021.
POPIA has increased awareness of privacy responsibilities among organisations and created greater accountability for handling personal data. It also gives citizens stronger rights over their information. They are able to know how their data is being used and to challenge misuse.
The introduction of Popia brought about an increased focus on privacy scholarship. My analysis showed this moved through three distinct phases.
In the early period, 2013-2017, research focused mainly on understanding the newly enacted Popia and what it would mean for organisations. Much of the work examined the purpose, scope and obligations of the legislation while many of its substantive provisions had not yet come into operation. Keywords such as privacy, data protection and personal information dominated the conversation, reflecting efforts to interpret the new law and anticipate its practical implications.
During the middle period 2018-2020, the conversation broadened. Researchers explored the technical and organisational realities of protecting personal information. Topics that gained prominence included:
- cloud computing (storing and managing information online)
- cybersecurity (protecting systems and information from digital threats)
- ethics (ensuring information is used responsibly)
- institutional compliance (helping organisations follow privacy rules and regulations).
This signalled a shift from asking what the law meant to asking how organisations should put it into practice.
Following full enforcement of POPIA, the period 2021-2025 saw a sharp increase in research output and a stronger focus on practical solutions. The analysis showed that studies began examining:
- compliance strategies (how to follow the law)
- ethical handling of data (collecting and using personal information responsibly)
- operational challenges in implementing privacy protections (practical difficulties of keeping information secure and complying with regulations).
New conversations started emerging around community-based compliance, non-profit organisations and public awareness programmes. This shows that South Africa’s privacy scholarship is evolving.
What South Africa studies most about privacy
The keyword analysis from my study helped identify themes and patterns in the scholarship.
The strongest themes in South African privacy research can be grouped into three broad areas:
- understanding privacy law
- developing technical safeguards
- helping organisations comply with legal requirements.
These are all essential areas of research. But they are not the whole picture.
Who is still missing from the conversation?
Several important areas remain underexplored. One possible reason is that research often follows where funding, resources and expertise are concentrated. That is typically in larger organisations, government institutions and major urban centres. Smaller organisations and vulnerable communities may be less able to participate in research initiatives.
Sectoral gaps: Most research focuses on government institutions, corporations and formal organisational settings. Yet smaller organisations often collect highly sensitive personal information while operating with limited technical capacity and fewer compliance resources.
Disciplinary gaps: Much of the existing work comes from legal and technical perspectives. Comparatively little research explores privacy as a social, ethical or behavioural issue. This includes how ordinary people understand consent, digital trust, or their rights over personal information.
Geographical gaps: Research output is heavily concentrated in major urban centres in Gauteng and the Western Cape. This leaves other provinces underrepresented. It limits our understanding of privacy challenges in rural communities, smaller towns and under-resourced areas. In these regions, digital literacy, access and institutional capacity may differ significantly.
Citizen awareness gaps: In practice, privacy protection depends not only on regulation but also on whether citizens understand how their information is being used and what rights they have.
As more South Africans live, work and access services online, privacy protection cannot remain a conversation for lawyers, regulators and large organisations alone. It must also reflect the lived realities of vulnerable communities. A privacy system is only as strong as the protection it offers those most at risk.
- is a Lecturer, Sol Plaatje University
- This article first appeared in The Conversation
