How to make a data deletion request in South Africa

A data deletion request should be specific, factual, and trackable. POPIA may support deletion or correction in some cases, but the result depends on the organisation's records and lawful basis.

Start with the right organisation

Identify the company, data broker, credit bureau, lead source, marketing database, or public record holder that may hold your information. If you are not sure, you may need to start with an access request or a scan that points to likely sources.

What to include

• Your name and contact details.
• The specific information or record you are asking about.
• The POPIA basis for the request, such as correction, deletion, objection, or confirmation of processing.
• Enough detail for the organisation to identify the record without exposing unnecessary personal information.
• A request for written confirmation or the lawful basis for refusal.

Track the response

Keep a copy of the request, the date sent, the email address or portal used, any ticket number, and all replies. This evidence matters if the response is delayed, incomplete, or refused.

What if the organisation refuses?

A refusal does not always mean the organisation is wrong. It may have a lawful basis to keep the record. The useful next step is to record the reason, check whether it is specific, and decide whether a correction, objection, follow-up, or complaint is appropriate.

How DataRights helps

DataRights helps subscribers prepare requests, send them to covered data holders, track the status, and prepare escalation material where appropriate. It avoids marking deletion as confirmed unless there is documented confirmation or another clear basis.

Related guides

• POPIA data rights in South Africa
• What to do after a data breach in South Africa
• POPIA compliance overview