Wikimedia Commons/Graham Crumb/ Permission: http://imagicity.com/about-2 Imagine receiving a message from your bank about suspicious activity on your account, only to discover that someone has accessed your personal information after an organisation you trusted suffered a data breach. Or finding that your medical records or identity details have been exposed online without your knowledge. As more South Africans use digital services for banking, healthcare, education and social media, such incidents are becoming an increasing concern.
Privacy breaches involving personal information do not affect everyone equally. Some people are more vulnerable than others because of their social circumstances, limited digital literacy, economic dependence, or the sensitive nature of the information they share online.
People who may be disproportionately affected include older adults who are less familiar with digital technologies, low-income communities with limited access to digital literacy programmes and children whose personal information is often shared by parents, schools or caregivers. People who rely on community organisations or informal support networks can also face privacy risks.
For example, a stokvel (community-based saving group) may collect members’ identity numbers and banking details to manage contributions, while neighbourhood lift clubs often share names, phone numbers and locations through messaging apps. These are everyday activities that depend on trust, making the responsible handling of personal information especially important. If this information is mishandled or exposed, the consequences can be significant for those involved.
When personal health information is compromised, the consequences can extend far beyond fraud or identity theft. People could be exposed to stigma, discrimination and loss of dignity.
I am a researcher whose work focuses on privacy and social media use in South Africa, particularly how people and communities share sensitive information online. In a recent study, I analysed published South African research on privacy and data protection to understand what scholars are studying, and what may be receiving less attention.
I found encouraging growth in this research in South Africa. Much of the work has focused on areas such as legal rules, cybersecurity measures that protect systems from attacks and organisational practices that help institutions handle information responsibly.
But important blind spots remain. Vulnerable groups receive limited attention in the research. The same is true for community structures such as non-profit organisations, civil society groups, community-based organisations and small enterprises. These institutions regularly handle sensitive personal information with limited resources, little compliance support and low public awareness of privacy risks.
This matters because research often shapes public discussion, policy priorities and awareness programmes. If vulnerable communities receive little attention in research, the challenges they face may also receive less visibility in efforts to improve privacy protection. Solutions won’t be reached with them in mind.
South Africa has legislation in place to protect sensitive information such as children’s data, health records and religious beliefs. The Protection of Personal Information Act (known as Popia) introduced major compliance requirements from July 2020, with full enforcement beginning in July 2021.
Popia has increased awareness of privacy responsibilities among organisations and created greater accountability for handling personal data. It also gives citizens stronger rights over their information. They are able to know how their data is being used and to challenge misuse.
The introduction of Popia brought about an increased focus on privacy scholarship. My analysis showed this moved through three distinct phases.
In the early period, 2013-2017, research focused mainly on understanding the newly enacted Popia and what it would mean for organisations. Much of the work examined the purpose, scope and obligations of the legislation while many of its substantive provisions had not yet come into operation. Keywords such as privacy, data protection and personal information dominated the conversation, reflecting efforts to interpret the new law and anticipate its practical implications.
During the middle period 2018-2020, the conversation broadened. Researchers explored the technical and organisational realities of protecting personal information. Topics that gained prominence included:
cybersecurity (protecting systems and information from digital threats)
institutional compliance (helping organisations follow privacy rules and regulations).
This signalled a shift from asking what the law meant to asking how organisations should put it into practice.
Following full enforcement of Popia, the period 2021-2025 saw a sharp increase in research output and a stronger focus on practical solutions. The analysis showed that studies began examining:
ethical handling of data (collecting and using personal information responsibly)
operational challenges in implementing privacy protections (practical difficulties of keeping information secure and complying with regulations).
