Who we are

The South African Health Products Regulatory Authority (SAHPRA) is is a Section 3A public entity in terms of the Public Finance and Management Act, 1999 (Act 1 of 1999), and established in terms of the Medicines and Related Substances Act, 1965 (Act 101 of 1965), and is mandated to oversee the regulation of health products which includes medicines, medical devices, in-vitro diagnostic tests and devices, radiation emitting products and devices used in health care and industry. As such, SAHPRA is a public body exercising a public power or performing a public function in terms of legislation.

Our website address is: www.sahpra.org.za which is further supported by https://sahpracm.org.za.

What personal data we collect and why we collect it

Notification: Collection of Personal Information

In terms of section 38 of the Protection of Personal Information Act, 2013 (Act 4 of 2013), SAHPRA as a public body is exempt from specific provisions of the Act (sections 11(3) and (4), 12, 15 and 18) for the purposes of discharging a relevant function particularly in relation to the protection of the public.

In terms of section 18 of the Protection of Information Act, 2013 (Act 4 of 2013):

By registering as a user of this site or submitting any application, this site and its database holds all personal, including contact, information that you may have submitted for yourself or a third party. This also includes any financial activity directly associated with the SAHPRA. Any information collected as part of any application is stored separately to a user profile. User profile information may be viewed on your profile page once logged in to the SAHPRA CM website www.sahpracm.org.za and may be modified by the user directly or by request to the SAHPRA's listed contact details.

Successful application data may be made public in terms of the Medicines and Related Substances Act, 1965 (Act 101 of 1965) (the Medicines Act).

Unless otherwise provided for by the Medicines Act:

(1) only authorised individuals of the SAHPRA will have access to all other information collected; and

(2) the SAHPRA undertakes not to transfer any other information to any third party, sell any part of its database or distribute any lists of information other than those activities specifically listed herein.

Where indicated the supply of particular information is mandatory while other information is voluntarily disclosed. In general, the collection of the stipulated information will assist the SAHPRA in providing access to your services and as an effective means of contact and in execution of the mandate granted to SAHPRA in terms of the Medicines Act.

Any questions or concerns pertaining to the collection, sharing, use or destruction of personal data or the POPI Act can be sent via email using the CONTACT SAHPRA CM function on the site.

Notwithstanding the general exemptions which may be applicable to the SAHPRA in terms of the Protection of Personal Information Act, 2013 (Act 4 of 2013), after attempting to resolve any matter with the SAHPRA and failing the reasonable redress thereof, you are entitled to report any transgression of the Protection of Personal Information Act, 2013 (Act 4 of 2013), to the Information Regulator in the manner prescribed.

When visitors submit user registration requests, forms, applications, or leave comments on the site we collect the data shown in the relevant form, and also the visitor’s IP address and browser user agent string to help spam detection.

Please be aware that we may change our Statement of Privacy from time to time. If we do, we will update this Statement of Privacy at our website, so be sure to check back here frequently.

By using our website, applications, contact forms, other services and related pages directly or though an official representative, you signify your acceptance of our Privacy Policy. If you do not agree to this policy, please do not use our website, applications, contact forms, other services and related pages. Your continued use will mean that you accept our Privacy Policy together with any stated Terms and Conditions.


If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Contact forms

Information submitted through the contact forms on our site are sent to our company email.

We keep these submissions for customer service purposes only. They are never used for marketing purposes or shared with any third parties.

If you request a password reset, your IP address will be included in the reset email.


If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select "Remember Me", your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

Any information submitted as part of an specified application is expected to be stored by the SAHPRA (whether online or in electronic archives) indefinitely as may be required by the Medicines Act.

What rights you have over your data

You are entitled to view, change, remove or supplement your personal data by utilising the "Use Profile" function provided on the site at any time, other than maintenance or network outage periods when this function may not be available.

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

SAHPRA will consider your request in light of any other laws or regulations prohibiting SAHPRA from doing so. We undertake to respond to such a request within one month of the request being received.

Where we send your data

Visitor comments may be checked through an automated spam detection service.

How we protect your data and what data breach procedures we have in place

We protect customer data with the following site features:

  • We are entirely using SSL/HTTPS throughout all our sites. This encrypts our user communications with the servers so personal identifiable information is never captured by third parties without authorization.
  • Databases are sanitised (actual user personal details are removed) before deploying to development or testing environment.

In case of a data breach, system administrators will immediately go through affected users and will attempt to reset passwords if needed after informing the user.