Yes, scraping public data in South Africa is generally permissible if conducted within legal boundaries, but compliance with privacy and data protection laws is mandatory. Publicly accessible information does not inherently waive protections under the Protection of Personal Information Act (POPIA) or the Promotion of Access to Information Act (PAIA). The 2026 POPIA enforcement phase intensifies scrutiny on data processing activities, including scraping, requiring strict adherence to lawful basis, purpose limitation, and data minimization principles.
Key Regulations for Scraping Public Data in South Africa
- POPIA Compliance: Scraping must align with POPIA’s eight conditions, particularly lawful processing (Section 8), purpose specification (Section 12), and data minimization (Section 14). Personal data, even if publicly available, cannot be repurposed without a valid legal basis (e.g., legitimate interest or consent).
- PAIA Restrictions: The Promotion of Access to Information Act (PAIA) grants access to records held by public bodies but does not authorize systematic scraping. Automated extraction may violate PAIA’s provisions on “reasonable access” (Section 50) if it disrupts service or circumvents access procedures.
- Electronic Communications Act (ECA): The ECA prohibits unauthorized interference with electronic communications systems (Section 86). Aggressive scraping that overloads servers or bypasses rate limits may constitute an offence under this Act, especially if conducted without prior consent from the data controller.
Critical Considerations:
- Terms of Service: Violating a website’s terms—even for public data—may trigger contractual or tortious liability.
- Automated Tools: Use of bots or scrapers must comply with the Consumer Protection Act (Section 43) if targeting consumer-facing platforms.
- Jurisdictional Risks: Cross-border data transfers during scraping may require additional compliance under POPIA’s Regulation 4 (2021) and the EU-SA adequacy framework if data subjects are in the EU.