VPNs with servers in South Africa

The Amendment Bill (B 28B-2023) would require notice to the person surveilled within 90 days after a direction ends, unless a judge defers it. The President returned it in November 2024, doubting the protection for journalists and lawyers and the lack of review of deferred notice.

Section 54 of the Cybercrimes Act, which would require providers to report offences within 72 hours and preserve information, was left out of that Act’s commencement in December 2021. Whether a VPN operator is a provider under these Acts is not established.

The Films and Publications Amendment Act 11 of 2019, in force from 1 March 2022, extends the Film and Publication Board’s compliance functions to online distribution; commercial online distributors must register and classify content. Where content is hosted outside South Africa, the Board refers the matter to the police or the relevant foreign hotline.

The Cybercrimes Act 19 of 2020, in force in part from 1 December 2021, makes it an offence to disclose a data message by electronic communications service intending to incite damage to property or violence (section 14), or to threaten a person or group with such damage or violence (section 15). The 2002 Act separately requires an application concerning a journalist or practising lawyer to disclose that fact to the designated judge.

On 4 February 2021 the Constitutional Court upheld the finding that the Act is invalid on five grounds, for lack of safeguards, suspended the declaration for 36 months, and read in a default duty to notify the target within 90 days of a direction ending. The suspension expired on 3 February 2024.

The President applied to the Court after returning the Bill, and on 25 July 2025 it reinstated the interim measures of 2021 and provided for three designated judges to be nominated and appointed, so that the Act is operable again. The order of the rows is the security score, and a server’s location is not a recommendation.