Sources

Checked on 19 October 2026 · version 2026-10-19-u1

In short

The laws and the outside pages the Trust Centre quotes. Nothing here is legal advice: ask your attorney how the law applies to you.

South African law says information does not lose its legal force just because it is electronic. (ECTA, Act 25 of 2002, section 11.) https://www.gov.za/sites/default/files/gcis_document/201409/a25-02.pdf (checked 2026-10-19)
A court may not refuse an electronic record just because it is electronic, and must give it due weight. To judge its weight, the court looks at how reliably it was made, stored and sent, how its integrity was kept, and how the person who made it was identified. (ECTA section 15(1) to 15(3).) https://www.gov.za/sites/default/files/gcis_document/201409/a25-02.pdf (checked 2026-10-19)
A record made in the ordinary course of business, or a copy certified as correct by an officer of the business, can be used in court as proof of its contents unless someone proves otherwise. (ECTA section 15(4).) https://www.gov.za/sites/default/files/gcis_document/201409/a25-02.pdf (checked 2026-10-19)
Electronic records meet a duty to keep records if they stay readable, stay in their original format or one shown to be accurate, and show where they came from and when. (ECTA sections 14 and 16.) https://www.gov.za/sites/default/files/gcis_document/201409/a25-02.pdf (checked 2026-10-19)
Tax records must be kept for 5 years after the return is submitted, and longer during a SARS audit, objection or appeal. (Tax Administration Act 28 of 2011, sections 29 and 32; VAT Act section 55.) https://www.sars.gov.za/lapd-lprim-act-2012-01-tax-administration-act-2011 (checked 2026-10-19)
SARS's rule says electronic tax records must be kept at a place in South Africa, unless a senior SARS official gives permission to keep them elsewhere. (Government Notice 787 of 1 October 2012, rule 4, made under Tax Administration Act section 30.) https://www.sars.gov.za/gen-gen-23-pol02-manage-taxpayer-record-retention-authorisation-external-policy (checked 2026-10-19)
Company records and accounting records generally have to be kept for 7 years. (Companies Act 71 of 2008, sections 24 and 28.) https://www.gov.za/documents/companies-act (checked 2026-10-19)
Employers must keep records of each employee's time worked and pay for 3 years. (Basic Conditions of Employment Act 75 of 1997, section 31.) https://www.gov.za/documents/basic-conditions-employment-act (checked 2026-10-19)
An operator must have a written contract with the responsible party and must tell it immediately if there are reasonable grounds to believe personal information was accessed by someone without permission. (POPIA, Act 4 of 2013, section 21.) https://www.gov.za/documents/protection-personal-information-act (checked 2026-10-19)
The responsible party must tell the Information Regulator and the people affected as soon as reasonably possible after a security compromise is found. (POPIA section 22.) https://www.gov.za/documents/protection-personal-information-act (checked 2026-10-19)
Since 1 April 2025 the Information Regulator requires security compromises to be reported through its eServices portal, and the Information Officer must be registered there first. https://inforegulator.org.za/wp-content/uploads/2025/04/MEDIA-STATEMENT-INVITATION-TO-REPORT-SECURITY-COMPROMISES-THROUGH-THE-eSERVICES-PORTAL-.pdf (checked 2026-10-19)
Personal information may be sent to another country only under the conditions of POPIA section 72, for example where the receiver is bound by rules that protect it as well as POPIA does. https://www.gov.za/documents/protection-personal-information-act (checked 2026-10-19)
Google Cloud's list of certificates and reports. https://cloud.google.com/security/compliance/offerings (checked 2026-10-19)
Firebase's privacy and security page, with its certificates per service and where each service runs. https://firebase.google.com/support/privacy (checked 2026-10-19)
How Google encrypts stored data. https://docs.cloud.google.com/docs/security/encryption/default-encryption (checked 2026-10-19)
How Google secures its infrastructure and data centres. https://docs.cloud.google.com/docs/security/infrastructure/design (checked 2026-10-19)
Google's data-centre security page. https://datacenters.google/advancing-security/ (checked 2026-10-19)
Google Cloud's Data Processing Addendum. https://cloud.google.com/terms/data-processing-addendum (checked 2026-10-19)
Google Cloud's own list of sub-processors. https://cloud.google.com/terms/subprocessors (checked 2026-10-19)
Google Cloud's POPI Act page. https://cloud.google.com/security/compliance/south-africa-popi (checked 2026-10-19)
Anthropic's commercial terms. https://www.anthropic.com/legal/commercial-terms (checked 2026-10-19)
PayFast's security page. https://payfast.io/security-fraud/ (checked 2026-10-19)
The Information Regulator (South Africa). https://inforegulator.org.za (checked 2026-10-19)