South African businesses handling the personal data of European Union customers fall within the scope of the EU’s General Data Protection Regulation regardless of where the business itself is located, which means GDPR obligations apply alongside, not instead of, South Africa’s own POPIA requirements. Businesses selling into the EU, even occasionally, need to account for both.
GDPR has been in force since 2018 and applies extraterritorially, meaning a South African business with EU customers is subject to it in the same way an EU-based business is, a point many smaller exporters and online sellers still overlook.
Location of the business does not determine whether GDPR applies
What matters is whose personal data is being processed, not where the processing happens, so a South African business collecting data from customers in the EU carries GDPR obligations even with no European office, staff or servers.
Breach notification timelines are tight and specific
GDPR requires notification of a personal data breach to the relevant regulator within 72 hours, which is a considerably shorter window than businesses accustomed to handling incidents internally typically plan for, and meeting it requires a response process defined in advance rather than improvised.
Data collection and storage practices need documenting
Both GDPR and POPIA expect a business to be able to demonstrate what data it holds, on what lawful basis it was collected, how it is secured and how long it will be kept, which means documentation is itself part of compliance rather than an administrative extra.
Overlapping regimes are best handled with one standard
Rather than maintaining separate processes for EU and South African customers, most businesses find it considerably simpler to build to the stricter of the two standards and apply it uniformly, which reduces the risk of the wrong process being applied to the wrong customer.
Frequently asked questions
Does GDPR apply to a South African business with no European presence?
Yes, if it processes the personal data of individuals in the EU. GDPR applies based on whose data is processed rather than where the business or its systems are located.
How quickly must a data breach be reported under GDPR?
Within 72 hours to the relevant regulator, a considerably tighter window than many businesses plan for, which requires a response process defined in advance rather than improvised during an incident.
Does GDPR replace a South African business’s POPIA obligations?
No. The two apply alongside each other, meaning a business serving both markets carries obligations under both regimes simultaneously.
What documentation do these regulations expect?
Evidence of what data is held, the lawful basis for collecting it, how it is secured and how long it will be retained, with the documentation itself forming part of compliance rather than an optional extra.
Is it easier to run separate processes for EU and local customers?
Usually not. Most businesses find building to the stricter standard and applying it uniformly simpler and less risky than maintaining parallel processes that can be applied to the wrong customer.
Further reading
Originally published in December 2017. Updated September 2026 to reflect that GDPR is now long in force and to set out how it operates alongside South Africa’s own POPIA obligations.
