Regulatory Environment: South Africa
Cybersecurity-related laws, regulations, and codes are becoming more relevant—and in many cases, compliance is now a formal expectation.
This page gives you a clear, practical overview of the Acts, Standards, and Codes that may apply to your organisation.
For each one, we show:
- What the law or standard is about
- Who it applies to
- What your main obligations are
- What happens if you don’t comply
- And where ARMD.digital’s products can help support compliance
Please note:
The summaries provided on this page reflect our own interpretations and are for informational purposes only. They do not constitute legal advice.
Understanding Different Types of Regulation
Not all regulatory instruments work the same way. Some tell you what outcomes to achieve. Others tell you exactly how to do it. Some are industry-specific frameworks that guide governance and ethical leadership.
Here’s how they differ:
Principle-Based Laws
These set broad goals or outcomes (e.g. “protect personal data”) and give organisations the flexibility to decide how to meet them.
Rules-Based Laws
These are prescriptive. They set out specific steps, controls, and procedures you must follow.
Codes
Codes are best-practice frameworks for governance, leadership, and risk management.
The King IV™ Code, for example, is mandatory for companies listed on the Johannesburg Stock Exchange (JSE), and recommended best practice for others.