South Africa passenger data record

Last checked: 21 October 2026 · Country records

South Africa runs interactive advance passenger information (API), known locally as Advance Passenger Processing, under the Department of Home Affairs ^2,9. ICAO listed South Africa in July 2024 as having API in force and as developing a legal basis for passenger name record (PNR) data ⁷. The Presidency announced that an Electronic Travel Authorisation using biometric verification would launch on 12 August 2026 ⁴. In October 2026 the Auditor-General reported that under 4% of movements at 68 ports went through the biometric movement control system ⁶.

Data protection law: Protection of Personal Information Act 4 of 2013 (POPIA), main sections in force from 1 July 2020 ¹
Data protection authority: Information Regulator ^1,3
Agency that receives API/PNR: Department of Home Affairs as custodian of the API system ². The BMA said in October 2025 that the Advanced Passenger Processing system had not yet been transferred to it ⁵
API/PNR status: API live, interactive, in use about 10 years as of 2019 ². PNR not confirmed, legal basis in development as of 18 July 2024 ⁷
Biometric collection at entry: Yes, partly. BMCS installed at 68 ports but used for under 4% of movements ⁶
Border agency: Border Management Authority under the Border Management Authority Act No. 2 of 2020 ⁸
Date checked: 21 October 2026 ^4,6 ⁸

The data protection law and regulator

POPIA is Act 4 of 2013 ¹. Section 1 and Part A of Chapter 5 (sections 39 to 54) came into force on 11 April 2014 ¹. Sections 2 to 38, 55 to 109, 111 and 114(1) to (3) came into force on 1 July 2020 ¹. Sections 110 and 114(4) followed on 30 June 2021 ¹.

The Information Regulator issues enforcement notices under section 95 of POPIA ³. Its published list includes notices to the South African Police Service and the Department of Justice and Constitutional Development in May 2023 ³. No notice addressed to the Department of Home Affairs, the Border Management Authority (BMA), an airline or an airport appeared on that list when checked on 21 October 2026 ³.

Advance Passenger Processing and PNR

In a 2019 presentation to the ICAO TRIP Symposium, the South African Civil Aviation Authority said South Africa uses interactive API and had done so for about 10 years ². The presentation says the system gives the option to deny or accept a passenger ². About 40 airlines and about 12 million passengers were covered ². API information is shared with other agencies, including the Police and State Security, and a 24-hour operational centre validates all hits ². Airlines that do not follow the requirements face penalties ².

Government news reported on 15 June 2010 that 37 of the 54 airlines flying to South Africa had signed up to Advance Passenger Processing, and that it produced 21 hits between 1 and 13 June 2010 ⁹.

An ICAO Africa facilitation session on 18 July 2024 listed South Africa among six African states with API in force ⁷. The same slides listed it among ten states developing a legal basis for PNR or expecting to do so soon ⁷. This page found no official record that PNR collection is live.

Movement control, biometrics and the ETA

The Presidency announced on 6 August 2026 that President Cyril Ramaphosa and Home Affairs Minister Leon Schreiber would launch the Electronic Travel Authorisation (ETA) at OR Tambo International Airport on 12 August 2026 ⁴. The release said the ETA combines biometric verification, machine learning and the upgraded Electronic Movement Control System (eMCS 2.0) ⁴. It did not say what data the ETA collects or how long it is kept ⁴.

The BMA annual report for 2025-26 says eMCS 2.0 incorporates facial recognition-based border management capabilities ⁸. It says the ETA was piloted at OR Tambo and Cape Town International Airports during South Africa's G20 Presidency ⁸. No vendor for the ETA, eMCS 2.0 or the biometric movement control system (BMCS) was named in the official records checked ^4,8.

Auditor-General findings

On 7 October 2025 the Auditor-General of South Africa (AGSA) told the Portfolio Committee on Home Affairs that the department still depended on legacy systems such as HANIS and had integration problems with the automated biometric identification system (ABIS) and the BMCS ⁵. BMA Deputy Commissioner Jane Thupana said at that meeting that the Movement Control System and the Advanced Passenger Processing system had not yet been transferred from Home Affairs ⁵. The meeting record says the goal was to complete the transfers by December ⁵.

In slides dated 2 October 2026 for the committee's budget review, AGSA reported the findings below ⁶. The slides note an audit cut-off date of 31 August 2026 ⁶.

System	AGSA finding, 2 October 2026
BMCS	Less than 4% of movements across the 68 installed ports processed on BMCS since roll-out ⁶
EMCS	Remains the de facto primary system and lacks facial and biometric capability ⁶
Manual ports	17 of 71 ports remain fully manual, with paper records later captured in Excel ⁶
Watch list	Officials cannot reliably verify V-listed or prohibited travellers ⁶
Exits	2,393,380 unrecorded exits identified ⁶
ABIS	ABIS phase 2 was suspended and not implemented in production, facial recognition was not operational and ABIS is planned for decommissioning ⁶
e-Visa and ETA	eVisa rolled out in 38 of 106 planned countries ⁶

Official responses

At the 7 October 2025 meeting, Director-General Makhode said the ETA would replace manual visa applications and reduce the risks AGSA identified ⁵. Minister Schreiber said the ETA would address the fragmentation identified in audit reports over time ⁵. Thupana said the chief financial officers of the BMA and the department were leading bi-weekly meetings to monitor progress on the transfers ⁵.

The BMA annual report for 2025-26 says the BMA received its first unqualified audit opinion and resolved the two qualification findings from 2024-25 ⁸. The AGSA slides record a 2024-25 recommendation as in progress, noting that the ETA and eMCS 2.0 were piloted during the financial year ⁶. A department or BMA response to the specific October 2026 systems findings was not found in the records checked ⁶.

Common questions

Does South Africa collect API data from airlines?

Yes. South Africa uses interactive API, run by the Department of Home Affairs, and ICAO listed its API as in force in July 2024 ^2,7.

Does South Africa collect PNR data?

Not confirmed. ICAO slides from 18 July 2024 listed South Africa as developing a legal basis for PNR ⁷.

Who regulates personal data at South African borders?

The Information Regulator enforces POPIA, the Protection of Personal Information Act 4 of 2013 ^1,3.

What did the Auditor-General find about border biometrics?

AGSA reported on 2 October 2026 that under 4% of movements at 68 installed ports went through the BMCS ⁶.

When did the South African ETA launch?

The Presidency set the launch for 12 August 2026 at OR Tambo International Airport ⁴.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email [email protected] with the official link.

Sources

Advance Passenger Information (API) explained
What API data is, which fields airlines send, who receives it, the legal basis, how long it is kept, and examples from four jurisdictions.
Interactive API and board or no-board decisions
How interactive Advance Passenger Information lets border authorities answer board or no-board at check-in, with US, Canadian and UK examples.
E-visa and electronic travel authorisation data
What US ESTA, UK ETA, Canada eTA, Kenya ETA, EU ETIAS and India e-Visa collect from travellers, and how long the data is kept.
Biometric data at borders
Which fingerprints and facial images border agencies collect from travellers, the legal basis, who holds the records and how long they are kept.
Who oversees passenger data
The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.