POPIA and your personal information
A loan application asks for more sensitive information than almost anything else you do online: your ID number, your income, your bank transactions. The Protection of Personal Information Act governs what may be done with it, and the Information Regulator has been explicit that lead generation counts as direct marketing.
What you need to know
You are entitled to know what is collected, why, and who it will be shared with. A tick-box consenting to share your details with unnamed partners is the one to read most carefully — it is how a single application becomes months of calls from lenders you never approached.
Consent must be specific and informed, and you can withdraw it for marketing at any time. Withdrawing marketing consent does not affect an existing credit agreement.
You may ask what personal information an organisation holds about you and require correction of anything inaccurate. If a request is ignored, you can complain to the Information Regulator.
Before you enter your ID number anywhere, check that the site is a registered credit provider. Handing sensitive information to an unregistered lead-capture page is the start of a great many South African identity fraud cases.
Related
Sources and last checked
- Information Regulator — guidance note on direct marketing under POPIA — Regulator guidance, as at 10 August 2026.
- National Credit Regulator — register of credit providers — Regulator, as at 10 August 2026.
Page last checked 10 August 2026. Statutory caps and lender terms change — confirm anything you intend to rely on with the provider or the National Credit Regulator. Found something wrong? Tell us and we will correct it.