Is Your ISP Spying on You? South Africa’s Cybercrime Laws Explained

South Africans use the internet every day to watch movies, stream television, browse websites, shop online and communicate with others. But what happens when someone uses the internet to commit a crime or watch copyrighted content without permission? And can your internet service provider (ISP) be held responsible for what you do online?

South Africa has several laws dealing with internet use, online crime and personal information. These include the Electronic Communications and Transactions Act 25 of 2002 (ECTA), the Regulation of Interception of Communications and Provision of Communication-related Information Act 70 of 2002 (RICA), the Protection of Personal Information Act 4 of 2013 (POPIA) and the Cybercrimes Act 19 of 2020.

The Cybercrimes Act was introduced to deal more directly with crimes committed using computers, computer systems and data. Most of its principal cybercrime offences came into operation on 1 December 2021.

However, these laws do different jobs. They do not mean that your internet service provider must constantly watch everything you do online.

Does the Cybercrimes Act Force ISPs to Monitor Your Internet Activity?

No. South African law does not generally require internet service providers to monitor every customer’s internet activity or actively search for illegal behaviour.

Section 78 of ECTA specifically provides that eligible service providers, when providing the services covered by its intermediary-liability chapter, have no general obligation to monitor the information they transmit or store, or to actively look for signs of unlawful activity.

This does not mean that internet activity can never be monitored or investigated. Other laws may authorise or require particular actions in specific circumstances, and service providers may have obligations under applicable legislation, licences or court orders.

In simple terms, your ISP is not generally required to inspect every movie you stream or every website you visit to determine whether you are breaking the law.

It is also important to understand that section 54 of the Cybercrimes Act, which deals with reporting obligations for electronic communications service providers and financial institutions, had not been brought into operation according to the latest consolidated legislation I could verify for this article. It should therefore not be treated as an operative general reporting obligation in 2026 without confirmation of a later commencement proclamation.

What About Illegal Streaming and Copyright Piracy?

Watching or downloading copyrighted movies, television programmes or sporting events without the necessary permission may infringe copyright. Whether a particular activity is unlawful depends on the circumstances and the rights involved.

Copyright infringement is dealt with primarily under South Africa’s copyright legislation, including the Copyright Act 98 of 1978, as amended. ECTA may also be relevant when an online service provider is involved.

There is an important difference between watching unauthorised content, distributing copyrighted material without permission and hacking into someone else’s account.

For example:

The Cybercrimes Act is not a law that automatically turns every copyright infringement into a cybercrime. The specific conduct and applicable legal provisions determine which offences, if any, have been committed.

Can an ISP Be Held Responsible for What Its Customers Do Online?

An internet service provider is not automatically legally responsible for every unlawful act committed by someone using its internet connection.

ECTA contains provisions that can limit the liability of qualifying service providers for certain activities carried out through their services. These protections are commonly known as safe-harbour provisions.

However, the protection is not unlimited. Different rules apply depending on whether the provider is simply transmitting information, temporarily storing it, hosting content or providing tools that help people find information. The provider must also satisfy the relevant statutory requirements.

For this reason, it would be incorrect to say that an ISP can never be held liable for a customer’s online activity.

Nor is it correct to say that an ISP automatically loses all protection whenever a customer infringes copyright.

The legal position depends on the provider’s role, the facts of the case and the relevant legislation.

What Is a Notice-and-Takedown Request?

ECTA provides a procedure through which a person can notify an eligible service provider of allegedly unlawful online activity or material.

In broad terms, a notice-and-takedown request identifies the material or activity in question, explains the right allegedly infringed and specifies the action requested. The notice must meet the applicable statutory requirements.

This process can be relevant when copyrighted material is hosted on a website or other online service. It is not, however, a universal procedure that automatically applies to every instance of illegal streaming.

A notice to an ISP does not necessarily mean that the ISP must disconnect a customer immediately. The legal position depends on the type of service, the material concerned, the applicable rules and the circumstances.

When Must an ISP Report a Cybercrime?

The Cybercrimes Act contains a provision specifically addressing reporting obligations for electronic communications service providers and financial institutions.

Section 54 deals with certain categories of cybercrime and provides for reporting to the South African Police Service (SAPS), together with the preservation of information that may assist an investigation. Its application depends on the prescribed requirements and its commencement status.

Because section 54 was listed as not yet in operation in the latest consolidated version I could verify, it would be misleading to state that it currently imposes a general reporting duty on all ISPs.

This does not mean that service providers are exempt from every reporting, information-preservation or assistance obligation. Other legislation, applicable regulatory requirements and lawful court orders may create obligations in particular circumstances.

It is also important to distinguish between reporting a suspected crime to the authorities and receiving a copyright complaint from a private company. These are different processes with different legal implications.

Can the Authorities Investigate Online Activity?

Yes. South African law provides mechanisms for investigating suspected cybercrime and obtaining relevant evidence where the legal requirements are met.

Depending on the circumstances, the authorities may use applicable criminal-procedure powers and lawful procedures under legislation governing electronic communications and the interception of communications.

RICA regulates the interception of communications and certain related information. It does not give every private company or copyright owner unrestricted authority to monitor people’s communications.

An investigation must follow the applicable legal requirements. The fact that someone uses an ISP’s network does not, by itself, mean that the ISP must continuously monitor that person’s activity.

What Does This Mean for Ordinary Internet Users?

The main points are straightforward:

The bottom line: South African law does not generally require internet service providers to spy on customers simply to check whether they are streaming copyrighted movies or television programmes. But that does not make illegal streaming lawful, guarantee that an ISP can never be held responsible, or prevent authorities from investigating suspected offences through lawful procedures.

Need help with ICT compliance? Contact us today to ensure your business meets all regulatory standards.