Criminal framework

Cybercrimes Act 19 of 2020 section 16 (disclosure of data message of intimate image). The statute was enacted Substantially in force from December 2021. Up to 3 years imprisonment or fine, or both. Up to 5 years where the disclosure causes substantial harm.

Civil and data protection framework

Protection of Personal Information Act (POPIA) section 24 (right to deletion) provides the parallel civil route. Information Regulator (South Africa) (Information Regulator) is the national supervisory authority and accepts complaints against any controller processing intimate imagery without lawful basis. The official site is https://inforegulator.org.za.

Official victim support

South African Police Service Cyber Crime is the recognised support service. Available at https://www.saps.gov.za.

Five step removal process for South Africa victims

  1. 1

    Preserve evidence before any contact with the perpetrator

    Capture full page screenshots with URLs visible. Save the original files. Note timestamps. This evidence supports both the Cybercrimes Act 19 of 2020 section 16 complaint and any Protection of Personal Information Act (POPIA) section 24 (right to deletion) request.

  2. 2

    File a criminal complaint under Cybercrimes Act 19 of 2020 section 16

    Report to local police or the national cybercrime unit. South African Police Service Cyber Crime can assist with the report.

  3. 3

    Submit an erasure request under Protection of Personal Information Act (POPIA) section 24 (right to deletion)

    Send a written request to each platform's designated data protection contact citing the legal basis. Information Regulator can be petitioned if the platform fails to comply within 30 days.

  4. 4

    Send a US TAKE IT DOWN Act notice in parallel for covered platforms

    When the platform is subject to US jurisdiction, the 48 hour federal removal obligation applies in parallel with your domestic rights. ScanErase files these notices automatically.

  5. 5

    Track and escalate non compliant platforms

    Document every notice and every response. Escalate non compliant platforms through the regulator complaint process.

Frequently asked questions

What is the criminal NCII statute in South Africa?

Cybercrimes Act 19 of 2020 section 16 (disclosure of data message of intimate image). Enacted Substantially in force from December 2021. Up to 3 years imprisonment or fine, or both. Up to 5 years where the disclosure causes substantial harm.

Who enforces data protection rights in South Africa?

Information Regulator (South Africa) (Information Regulator) is the national authority. Official site: https://inforegulator.org.za.

Is there an official victim support service in South Africa?

Yes. South African Police Service Cyber Crime provides direct help to victims. Site: https://www.saps.gov.za.

Can a South Africa resident also use the US TAKE IT DOWN Act?

Yes when the hosting platform is subject to US jurisdiction. The TAKE IT DOWN Act applies to covered platforms regardless of where the victim resides. ScanErase's scan finds every US covered platform hosting your images, so you can file notices there in parallel with Protection of Personal Information Act (POPIA) section 24 (right to deletion) requests.

Related guides