Can I immediately terminate a user's account for violating the AUP?

Yes, for severe violations — and the AUP should clearly identify which violations warrant immediate termination without prior warning. These typically include: distribution of child sexual abuse material, imminent threats of violence, cyber fraud or extortion, distribution of malware or ransomware, and activities that constitute criminal offences under the Cybercrimes Act. For less severe violations — such as minor content guideline breaches, excessive resource usage, or first-time policy infractions — a graduated enforcement approach is recommended: warning, content removal, temporary suspension, then permanent termination. This graduated approach is important for CPA Section 48 compliance, which prohibits unfair contract terms. Immediate termination for trivial violations could be challenged as disproportionate and unreasonable. The AUP should clearly specify the enforcement tier for each category of violation, giving users fair notice of the consequences.

What are my reporting obligations under the Cybercrimes Act?

Section 54 of the Cybercrimes Act 19 of 2020 imposes reporting obligations on "electronic communications service providers" — defined broadly to include persons who provide electronic communications services. If your platform falls within this definition (which many SaaS platforms, social services, and marketplace operators do), you must report certain offences to the SAPS within 72 hours of becoming aware of them. The offences that trigger reporting obligations include those under Section 8 (cyber fraud), Section 9 (cyber forgery), Section 10 (cyber extortion), and the distribution of data messages that advocate, promote, or incite genocide, violence, or terrorism. The report must be made to a designated SAPS member and must include all available information about the offence. Failure to report is itself an offence under Section 54(3). Your AUP should inform users that illegal activities will be reported, that their data may be disclosed to law enforcement, and that evidence will be preserved as required.

How does ECTA's notice-and-takedown procedure work?

ECTA Chapter XI provides service providers with limited liability for third-party content they host — provided they comply with the notice-and-takedown procedure. When a rights holder (the complainant) believes content on your platform infringes their rights, they submit a takedown notice to your designated agent. The notice must include: the complainant's full name and contact details, a description of the allegedly infringing content, the location (URL) of the content, a statement that the complainant has a good faith belief the content infringes their rights, and a declaration under penalty of perjury. Upon receiving a compliant notice, you must expeditiously remove or disable access to the content (the Act does not define "expeditiously" — best practice is 24-48 hours). You must notify the user whose content was removed. The user may submit a counter-notice if they believe the content was wrongly removed, and if the complainant does not pursue legal action within a prescribed period, the content may be restored. The AUP must identify your designated agent and publish their contact details.

Should the AUP be a separate document or part of the Terms of Service?

Best practice is to maintain the AUP as a separate document that is incorporated by reference into the Terms of Service. This approach has several advantages. First, it allows you to update the AUP independently — adding new prohibited activities, adjusting enforcement procedures, or responding to new threats — without revising the entire Terms of Service, which may trigger CPA notification requirements for material changes. Second, it makes the rules more accessible to users — a dedicated AUP is easier to find and understand than usage rules buried within a lengthy Terms of Service. Third, it allows you to present the AUP prominently during onboarding, particularly for platforms where content creation is a primary activity. The Terms of Service should clearly state that the AUP forms part of the agreement, that violations of the AUP constitute a breach of the Terms of Service, and that the AUP is incorporated by reference with the same legal force as the Terms of Service themselves.

How should hate speech be defined in a South African AUP?

South African law provides a specific legal definition of hate speech that should be reflected in the AUP. Section 10 of the Promotion of Equality and Prevention of Unfair Discrimination Act 4 of 2000 (PEPUDA) prohibits speech that advocates hatred based on prohibited grounds (race, gender, sex, pregnancy, marital status, ethnic or social origin, colour, sexual orientation, age, disability, religion, conscience, belief, culture, language, or birth) and that constitutes incitement to cause harm. The Constitutional Court in Qwelane v South African Human Rights Commission (2021) confirmed this definition and upheld the constitutionality of Section 10. Your AUP should reference this legal definition rather than attempting to create a platform-specific definition of hate speech. This provides legal certainty, aligns with South African constitutional jurisprudence, and ensures that enforcement decisions are grounded in established law rather than subjective platform standards.

What content moderation approach should I use?

The appropriate content moderation approach depends on your platform's scale, content type, and risk profile. Small platforms (under 10,000 users) may rely on manual moderation — human reviewers assess reported content against the AUP criteria. Medium platforms should implement a hybrid approach: automated tools flag potentially violating content (using keyword filters, image recognition, and machine learning classifiers), and human moderators make final decisions on flagged content. Large platforms typically require extensive automated moderation supplemented by scaled human review teams. Regardless of approach, the AUP should disclose the moderation methodology (automated, manual, or hybrid), commit to human review for account suspension and termination decisions, establish response timeframes for reported content, and provide a meaningful appeals process. Content moderation decisions that affect user accounts constitute processing of personal information under POPIA and must comply with the conditions for lawful processing.

How should I handle content that is legal in South Africa but violates community standards?

Platforms are not limited to prohibiting only illegal content — they can set community standards that are stricter than the law requires. For example, content that is vulgar, misleading, or contrary to the platform's values may be prohibited even if it does not violate any South African statute. However, the CPA requires that enforcement be fair and reasonable (Section 48). If you prohibit legal content, the AUP must clearly define the community standards, provide specific examples of prohibited content, explain the rationale, and apply the standards consistently across all users. Inconsistent enforcement — prohibiting content from some users while allowing identical content from others — is both a CPA fairness issue and a reputational risk. The graduated enforcement process should be calibrated so that community standard violations receive proportionate consequences (typically warnings and content removal) rather than the severe consequences reserved for illegal activity.

What happens if I fail to remove illegal content after being notified?

The consequences depend on the nature of the content and the notification mechanism. Under ECTA Chapter XI, if you receive a compliant takedown notice and fail to expeditiously remove the content, you lose the limited liability protection that ECTA provides — meaning you can be held directly liable for the infringing content as if you had created it yourself. For content that constitutes a criminal offence under the Cybercrimes Act — particularly child sexual abuse material, terrorist content, or content facilitating fraud — failure to remove and report may constitute an independent offence. Under POPIA, if the content exposes personal information in violation of the Act, failure to remove it after notification may constitute continued unlawful processing. Additionally, the platform may face civil claims from the affected rights holder or data subject for damages arising from the continued availability of the violating content. The AUP should establish clear internal processes for rapid response to takedown notices.

How should the AUP address data scraping and automated access?

Data scraping and automated access are significant concerns for many platforms and should be explicitly addressed in the AUP. The policy should prohibit automated access (bots, crawlers, scrapers) that is not explicitly authorised, define the authorised automated access channels (published APIs with approved credentials), specify the rate limits and usage quotas that apply to authorised automated access, prohibit circumvention of rate limits and access controls, and reserve the right to block IP addresses or API keys that exhibit scraping behaviour. From a legal perspective, data scraping may constitute unlawful access under Section 2 of the Cybercrimes Act (if it exceeds the scope of authorisation), copyright infringement under the Copyright Act (if the scraped content is protected), and a breach of the platform's Terms of Service (giving rise to contractual remedies). The AUP should make clear that unauthorised automated access is prohibited regardless of the purpose, and that the platform will take technical and legal measures to prevent it.

Do I need an appeals process for AUP enforcement actions?

Yes — an appeals process is both legally advisable and practically important. The CPA requires that contractual terms be fair and reasonable (Section 48), and a one-sided enforcement process with no right of appeal may be challenged as unfair. The appeals process should include the right to appeal any content removal or account action (except for CSAM and imminent violence, where appeal is after removal rather than before), a clear mechanism for submitting an appeal (typically a webform or email), review by a different person than the original decision-maker (ensuring independence), a defined timeframe for the appeal decision (typically 5-10 business days), and reinstatement of content or account access if the appeal is successful. The appeals process serves multiple purposes: it corrects genuine errors in content moderation, it demonstrates fair and reasonable enforcement, it provides a safety valve for users who feel aggrieved, and it builds trust in the platform's governance. Document all enforcement actions and appeal outcomes for audit purposes.

How often should I update the Acceptable Use Policy?

You should review and update the AUP at least annually, and immediately when triggered by specific events. Annual reviews should assess whether the prohibited content and activity categories remain current, whether enforcement procedures are working effectively, whether new laws or regulations have been enacted (the Cybercrimes Act regulations are still being developed), and whether new types of platform abuse have emerged that need to be addressed. Immediate updates may be needed when new legislation takes effect (such as new Cybercrimes Act regulations), when a significant enforcement gap is identified, when a new type of abuse or attack emerges, or when a court or tribunal decision affects the interpretation of relevant law. Under the CPA, material changes to the AUP must be communicated with reasonable notice — the template specifies 30 days for material changes. Non-material updates (clarifications, formatting, typographical corrections) can be made with shorter notice.

Contract TemplateClickwrap Agreements

Acceptable Use Policy
Template — South Africa

An attorney-drafted Acceptable Use Policy template designed specifically for South African digital platforms, websites, and online services. This comprehensive, legally compliant document defines permitted and prohibited uses, content standards, enforcement mechanisms, and reporting obligations — ensuring compliance with the Cybercrimes Act 19 of 2020, the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008, and the Protection of Personal Information Act 4 of 2013.

Join Waiting List See What's Included

Drafted by qualified South African attorneys

Reviewed for compliance with current legislation · Last updated April 2026

Why It Matters

Why Your Business Needs This Agreement

No Legal Basis for Removing Harmful Content

Without an AUP that specifically prohibits categories of harmful content and establishes enforcement procedures, the platform has no clear contractual basis for removing content — even content that is illegal, defamatory, or dangerous. Users who have their content removed can claim the platform acted arbitrarily if there are no published rules governing content standards. The AUP provides the legal foundation for every content moderation decision.

Criminal Liability Under the Cybercrimes Act

The Cybercrimes Act 19 of 2020 imposes reporting obligations on electronic communications service providers under Section 54. Platforms that become aware of criminal activity on their service must report it to the SAPS within 72 hours. Without an AUP that informs users of these obligations, establishes monitoring procedures, and defines the platform's reporting workflow, the platform risks non-compliance with its statutory obligations — which is itself a criminal offence under Section 54(3).

Loss of ECTA Safe Harbour Protection

ECTA Chapter XI provides limited liability protection for platforms hosting user-generated content — but only if the platform complies with the notice-and-takedown procedure. Without an AUP that implements this procedure, designates a receiving agent, and publishes their contact details, the platform has no safe harbour protection. This means the platform can be held directly liable for infringing content uploaded by its users — as if the platform had created the content itself.

Disproportionate Enforcement Challenged Under the CPA

The CPA requires that contractual terms — including enforcement provisions — be fair, just, and reasonable. An AUP that imposes immediate permanent termination for minor violations, provides no appeals process, or applies enforcement inconsistently across users may be challenged as containing unfair terms under Section 48. A graduated enforcement approach with clear, documented procedures and an appeals mechanism demonstrates the fairness that the CPA requires.

Platform Abuse Degrading Service Quality

Without an AUP that prohibits resource abuse — excessive API calls, bandwidth consumption, storage misuse, cryptocurrency mining — a small number of abusive users can degrade service quality for the entire user base. The AUP provides the contractual authority to enforce technical limits, throttle abusive accounts, and terminate users who persistently abuse shared resources.

Data Scraping Destroying Competitive Advantage

Competitors and data brokers can systematically scrape platform content — product listings, user reviews, pricing data, business information — without consequence if the AUP does not prohibit automated access and data extraction. The AUP, combined with the Cybercrimes Act's prohibition on unauthorised access (Section 2) and the Copyright Act's protection of original content, provides multiple enforcement mechanisms against scraping.

What is a Acceptable Use Policy?

An Acceptable Use Policy (AUP) is an essential governance document for any South African digital platform, website, or online service that provides user accounts, hosts user-generated content, or offers access to shared computing resources. The AUP establishes the rules of engagement — defining what users can and cannot do on the platform, the content standards they must meet, and the consequences of violations. Without an AUP, platforms lack a clear legal basis for moderating content, suspending abusive accounts, or cooperating with law enforcement — leaving them exposed to both user abuse and regulatory liability.

The South African regulatory environment for digital platforms involves multiple intersecting statutes that directly shape the content and enforcement provisions of an AUP. The Cybercrimes Act 19 of 2020 is the most recent and significant addition. It creates criminal offences for a range of online activities that an AUP must address: unlawful access to computer systems (Section 2), unlawful interception of data (Section 3), unlawful interference with data or computer programmes (Section 5), unlawful interference with a computer system (Section 6), cyber fraud (Section 8), cyber forgery and uttering (Section 9), cyber extortion (Section 10), and the distribution of malicious communications (Section 14). Crucially, Section 54 of the Cybercrimes Act imposes reporting obligations on "electronic communications service providers" — which the Act defines broadly to include persons who provide electronic communications services. SaaS platforms, social media services, marketplace operators, and cloud providers may fall within this definition, triggering an obligation to report certain offences to the South African Police Service (SAPS) within 72 hours of becoming aware of them.

The Electronic Communications and Transactions Act 25 of 2002 (ECTA) provides the framework for content moderation and intermediary liability. Chapter XI of ECTA establishes limited liability protections for service providers who host third-party content — but these protections are conditional on compliance with the notice-and-takedown procedure. When a rights holder notifies the platform of infringing content through a compliant takedown notice, the platform must "expeditiously" remove the content. The platform must designate an agent to receive takedown notices and publish the agent's contact details. Failure to comply with the notice-and-takedown procedure exposes the platform to liability for the infringing content it hosts.

The Consumer Protection Act 68 of 2008 (CPA) requires that the AUP — as part of the platform's contractual terms — be fair, just, and reasonable (Section 14), in plain language (Section 22), and not contain terms that are unfair, unreasonable, or unjust (Section 48). This means the enforcement provisions must be proportionate: the platform cannot impose disproportionate penalties for minor violations, and the user must have reasonable notice of what constitutes a violation and what the consequences are.

POPIA intersects with the AUP in several ways. Content that contains personal information of third parties (doxxing, identity theft, non-consensual sharing of personal information) violates POPIA and should be prohibited. The platform's enforcement actions — reviewing reported content, investigating violations, sharing user data with law enforcement — must comply with POPIA's processing requirements. And the AUP itself, as part of the platform's terms, must be consistent with the platform's Privacy Policy regarding data collection and processing.

This attorney-drafted template covers every critical area: permitted uses, prohibited content categories (illegal content, hate speech, defamation, IP infringement, harmful content), prohibited activities (hacking, scraping, spam, malware, DDoS), system and resource abuse, graduated enforcement with clear consequences, reporting and appeals mechanisms, law enforcement cooperation under the Cybercrimes Act, content moderation procedures, ECTA notice-and-takedown compliance, and modification provisions with CPA-compliant notice. Whether you operate a SaaS platform, marketplace, social community, cloud service, or any digital platform with user accounts, this AUP provides the governance framework your platform requires.

Who Needs This

SaaS platforms allowing user-generated content, collaboration, or interaction between users

Marketplace operators hosting third-party sellers, listings, and reviews

Social platforms, online communities, and forums operating in or serving South African users

Cloud service providers managing shared infrastructure used by multiple customers

E-commerce platforms with user accounts, reviews, and seller-generated content

Any South African website or application that provides user accounts and hosts user content

Educational platforms and learning management systems with student and instructor content

Communication platforms providing messaging, voice, or video services to users

Want early access to the Acceptable Use Policy template?

Join Waiting List

We'll email you the moment early access opens

The Cybercrimes Act 19 of 2020 Section 54 requires electronic communications service providers to report certain criminal offences to the SAPS within 72 hours — failure to report is itself a criminal offence under Section 54(3)

ECTA Chapter XI provides limited liability protection for platforms hosting user-generated content, but only if the platform complies with the notice-and-takedown procedure — non-compliance exposes the platform to direct liability for infringing content

The CPA Section 48 requires that enforcement provisions in the AUP be fair, just, and reasonable — disproportionate penalties for minor violations may be declared void by a court or the National Consumer Tribunal

Hate speech is defined in Section 10 of PEPUDA and was upheld by the Constitutional Court in Qwelane v SAHRC (2021) — platforms should reference this legal definition rather than creating their own

POPIA applies to the platform's content moderation activities — reviewing reported content, investigating users, and sharing data with law enforcement constitute processing of personal information and must comply with the conditions for lawful processing

Template Contents

Key Clauses Included

This Acceptable Use Policy template covers 11 essential sections, each drafted by South African attorneys.

Permitted Uses

Establishes the legitimate, authorised uses of the platform — what the service is designed for and how users may properly use it. Sets the baseline expectations for normal, authorised activity and provides the context against which prohibited uses are assessed. Includes the requirement that users comply with all applicable South African laws and regulations in their use of the platform.

Prohibited Content

Comprehensive list of content that users may not upload, share, store, or distribute through the platform. Categories include: content that violates South African criminal law (including the Cybercrimes Act and the Films and Publications Act 65 of 1996), hate speech as defined in Section 10 of the Promotion of Equality and Prevention of Unfair Discrimination Act 4 of 2000, defamatory material, content that infringes intellectual property rights (copyright, trademarks, patents), child sexual abuse material, non-consensual intimate images, content promoting violence or terrorism, and personal information shared without the data subject's consent in violation of POPIA.

Prohibited Activities

Activities that constitute platform misuse and may also constitute criminal offences under the Cybercrimes Act 19 of 2020. Includes: unauthorised access to computer systems or accounts (Section 2), unlawful interception of communications (Section 3), data scraping beyond authorised API limits, spam and unsolicited bulk communications, phishing and social engineering, distribution of malware, ransomware, or viruses, denial-of-service attacks or attempts to degrade service performance (Section 6), circumvention of security measures, impersonation of other users, and automated access (bots, crawlers, scrapers) without prior written authorisation.

System & Resource Abuse

Technical restrictions to prevent activities that degrade service quality for other users. Covers API call limits and rate limiting, bandwidth consumption caps, storage quota enforcement, excessive CPU or memory usage, automated access patterns that resemble denial-of-service behaviour, and the use of the platform's infrastructure for cryptocurrency mining, torrenting, or other resource-intensive activities not related to the platform's intended purpose.

Enforcement & Graduated Consequences

The graduated enforcement process that the platform will follow for violations. Tier 1: Warning — for first-time minor violations, the user receives a written warning identifying the violation and the applicable AUP provision. Tier 2: Content removal — offending content is removed with notification to the user. Tier 3: Temporary suspension — the user's account is suspended for a defined period (typically 7-30 days). Tier 4: Permanent termination — the user's account is permanently terminated and they are prohibited from creating new accounts. Severe violations (criminal activity, distribution of CSAM, imminent threats of violence) result in immediate termination without prior warning.

Content Moderation Procedures

The platform's content moderation approach — whether automated (AI-based content filtering), manual (human content reviewers), or hybrid. Specifies the response timeframes for reported content (typically 24-48 hours for initial review), the criteria for prioritising reports (severity of potential harm), the qualifications and training of content moderators, and the documentation maintained for moderation decisions. Addresses the limitations of automated moderation and the right to human review.

Reporting Violations & Appeals

How users can report AUP violations — including the reporting mechanism (in-platform button, email, webform), the information required in a report, the review process for reports, timeframes for enforcement decisions, and confirmation of action taken. Also establishes the user's right to appeal content removal or account suspension — including the appeal mechanism, the review process (conducted by a different reviewer than the original decision-maker), the timeframe for appeal decisions, and the reinstatement procedure for successful appeals. Fair appeals processes are important for CPA Section 48 compliance.

ECTA Notice-and-Takedown Compliance

Implements the notice-and-takedown procedure required by ECTA Chapter XI for platforms hosting user-generated content. Identifies the designated agent for receiving takedown notices (with name, email, physical address, and phone number), specifies the information required in a compliant takedown notice, the timeframe for removing reported content (typically 24-48 hours from receipt of a compliant notice), the counter-notice procedure for users who believe their content was wrongly removed, and the put-back process if the original complainant does not pursue legal action within the prescribed period.

Law Enforcement Cooperation & Cybercrimes Act Reporting

The platform's obligations under Section 54 of the Cybercrimes Act 19 of 2020. Electronic communications service providers must report certain offences to the SAPS within 72 hours of becoming aware of them. The AUP informs users that: illegal activities conducted through the platform will be reported to law enforcement, user data may be disclosed to the SAPS or other authorities pursuant to lawful investigation requests (search warrants, subpoenas, Section 27 preservation orders), the platform will preserve evidence as directed by law enforcement under Section 29 of the Cybercrimes Act, and cooperation with law enforcement is a legal obligation, not a discretionary decision.

Intellectual Property Protection

Provisions protecting the intellectual property rights of both the platform and third parties. Prohibits users from uploading content that infringes copyright (under the Copyright Act 98 of 1978), trademarks (under the Trade Marks Act 194 of 1993), or other IP rights. Establishes a repeat infringer policy — users who receive multiple valid takedown notices will have their accounts terminated. Addresses the ECTA safe harbour protections and the platform's responsibilities as an intermediary.

Modifications & Notice

How the AUP may be updated — the platform's right to modify the policy with reasonable notice (typically 30 days for material changes), the notification mechanism (email and in-platform notice), and how continued use after the effective date constitutes acceptance of the modified terms. Subject to CPA Section 14 requirements that material changes to terms be fair, just, and reasonable. Includes a version history with effective dates for transparency and audit purposes.

Legal Compliance

South African Law Compliance

Cybercrimes Act

Cybercrimes Act 19 of 2020

The Cybercrimes Act is the primary criminal legislation relevant to acceptable use policies. It creates offences for unlawful access to computer systems (Section 2), unlawful interception of data (Section 3), interference with data (Section 5), interference with a computer system (Section 6), cyber fraud (Section 8), cyber forgery (Section 9), cyber extortion (Section 10), and malicious communications (Section 14). Section 54 imposes reporting obligations on electronic communications service providers — requiring them to report certain offences to the SAPS within 72 hours of becoming aware of them. Section 27 provides for preservation of evidence orders, and Section 29 provides for seizure orders. The AUP should prohibit all activities that constitute cybercrimes and inform users of the platform's reporting obligations.

ECTA

Electronic Communications and Transactions Act 25 of 2002

ECTA Chapter XI is critical for platforms hosting user-generated content. It provides limited liability protection for service providers who act as intermediaries — meaning they host, cache, or transmit third-party content without initiating or modifying it. This protection is conditional on compliance with the notice-and-takedown procedure: when notified of infringing content through a compliant takedown notice, the platform must expeditiously remove the content. Section 75 protects service providers from liability for content they did not create or modify. Section 77 provides the takedown procedure. The platform must designate an agent to receive takedown notices and publish the agent's contact details. Without ECTA compliance, the platform may be held directly liable for user-generated content that infringes third-party rights.

CPA

Consumer Protection Act 68 of 2008

The CPA requires that the AUP — as part of the platform's contractual terms — be fair, just, and reasonable (Section 14), in plain language (Section 22), and not contain unfair, unreasonable, or unjust terms (Section 48). The enforcement provisions must be proportionate: the platform cannot impose disproportionate penalties for minor violations, and the user must have reasonable notice of what constitutes a violation and what the consequences are. Section 48(2)(d) specifically provides that a term is unfair if it requires the consumer to waive any rights, assume any obligation, or waive any liability on terms that are so adverse to the consumer that their agreement was not truly voluntary.

POPIA

Protection of Personal Information Act 4 of 2013

POPIA intersects with acceptable use policies in multiple ways. Content that exposes third-party personal information without consent (doxxing, identity-based harassment, non-consensual sharing of personal details) violates POPIA and should be prohibited. The platform's enforcement actions — reviewing reported content, investigating users, sharing data with law enforcement — constitute processing of personal information under POPIA and must comply with the conditions for lawful processing. Section 11 provides the right to object to processing, Section 22 requires breach notification, and Section 72 restricts cross-border transfers of evidence shared with international law enforcement agencies.

PEPUDA

Promotion of Equality and Prevention of Unfair Discrimination Act 4 of 2000

Section 10 of PEPUDA prohibits hate speech — defined as speech that advocates hatred based on race, gender, sex, pregnancy, marital status, ethnic or social origin, colour, sexual orientation, age, disability, religion, conscience, belief, culture, language, or birth, and that constitutes incitement to cause harm. The AUP should prohibit hate speech as defined under PEPUDA, which provides a clearer and broader definition than the common law. The Equality Courts have jurisdiction over hate speech complaints and can order content removal, issue interdicts, and award damages.

South African businesses are lining up for My-Contracts — be first in when we launch

Join Waiting List

POPIA CompliantLegally ReviewedDigital Signing Available

Simple Process

Create Your Acceptable Use Policy in Minutes

Our guided wizard walks you through every clause — no legal knowledge required. Attorney-drafted, South African law compliant.

Identify your platform's risk profile and content categories

Assess what types of content users can create, upload, or share on your platform, and what activities they can perform. Identify the highest-risk content categories (user-generated content, financial transactions, personal information sharing) and the highest-risk activities (automated access, resource-intensive operations, peer-to-peer interactions). This risk assessment determines the scope and detail of your AUP.

Define prohibited content and activities with specific examples

For each prohibited category, provide a clear definition and specific examples. Users should be able to understand what is prohibited without legal interpretation. Cross-reference the Cybercrimes Act offences (Sections 2-14), the PEPUDA hate speech definition (Section 10), and the Copyright Act infringement provisions. Generic prohibitions like "no inappropriate content" are unenforceable — specificity is essential.

Design the graduated enforcement process

Map each prohibited content and activity category to a specific enforcement tier (warning, content removal, temporary suspension, permanent termination). Severe violations should receive immediate termination; minor violations should receive warnings. Document the process clearly in the AUP, including timeframes for each stage, the format of notifications, and the user's right to appeal. Test the process against CPA Section 48 fairness standards.

Implement the ECTA notice-and-takedown procedure

Designate an agent to receive takedown notices and publish their contact details prominently on your website and in the AUP. Create a standardised takedown notice form that collects all information required by ECTA Chapter XI. Establish internal procedures for reviewing notices, removing content, notifying affected users, and processing counter-notices. Set response timeframes (24-48 hours for initial action).

Deploy and integrate with your Terms of Service

Publish the AUP as a standalone document on your website, clearly linked from your Terms of Service. Include a statement in the Terms of Service that the AUP is incorporated by reference and that violations constitute a breach. Configure your platform to present the AUP during user onboarding. Implement the reporting mechanism (in-platform reporting button), the appeals process, and the content moderation workflow. Train your team on the enforcement procedures and the Cybercrimes Act reporting obligations.

Your Acceptable Use Policy is ready

Common Questions

Frequently Asked Questions

An Acceptable Use Policy (AUP) is a governance document that defines the rules and boundaries for using a digital platform or service. It specifies what users can do, what they cannot do, the content standards they must meet, and the consequences of violations. Your platform needs an AUP for several legal and practical reasons. First, without one, you lack a clear contractual basis for moderating content, suspending abusive accounts, or terminating users who violate community standards. Second, the Cybercrimes Act 19 of 2020 creates criminal offences for online activities that your platform must prohibit and may be obligated to report to the SAPS under Section 54. Third, ECTA Chapter XI provides liability protection for platforms hosting user-generated content — but only if you comply with the notice-and-takedown procedure, which the AUP implements. Fourth, the CPA requires that your enforcement procedures be fair and reasonable, which means they must be documented and proportionate. An AUP is not optional — it is the legal and operational foundation for platform governance.

Why This Template

What You Get With This Template

Drafted specifically for South African digital platforms — compliant with the Cybercrimes Act 19 of 2020, ECTA Chapter XI, the CPA, and POPIA

Comprehensive prohibited content categories aligned with the Cybercrimes Act offences (Sections 2-14), PEPUDA hate speech provisions (Section 10), and Copyright Act infringement standards

Full ECTA notice-and-takedown procedure implementation with designated agent provisions, compliant notice requirements, counter-notice mechanisms, and response timeframes

Cybercrimes Act Section 54 reporting workflow including the 72-hour SAPS notification timeline, evidence preservation obligations, and law enforcement cooperation procedures

CPA-compliant graduated enforcement process with proportionate consequences, clear notice, and a meaningful appeals mechanism

System and resource abuse provisions to protect shared infrastructure from bandwidth, storage, and compute abuse

Customisable template with clearly marked decision points for content categories, enforcement tiers, response timeframes, and appeal procedures

Plain language drafting meeting the CPA Section 22 standard for accessibility and comprehension

Related Templates

You May Also Need

SaaS Terms of Service

View template →

Website Terms and Conditions

View template →

Cookie Policy

View template →

End User Licence Agreement (EULA)

View template →

Acceptable Use PolicyTemplate — South Africa

Why Your Business Needs This Agreement

No Legal Basis for Removing Harmful Content

Criminal Liability Under the Cybercrimes Act

Loss of ECTA Safe Harbour Protection

Disproportionate Enforcement Challenged Under the CPA

Platform Abuse Degrading Service Quality

Data Scraping Destroying Competitive Advantage

What is a Acceptable Use Policy?

Who Needs This

Key Clauses Included

Permitted Uses

Prohibited Content

Prohibited Activities

System & Resource Abuse

Enforcement & Graduated Consequences

Content Moderation Procedures

Reporting Violations & Appeals

ECTA Notice-and-Takedown Compliance

Law Enforcement Cooperation & Cybercrimes Act Reporting

Intellectual Property Protection

Modifications & Notice

South African Law Compliance

Create Your Acceptable Use Policy in Minutes

Identify your platform's risk profile and content categories

Define prohibited content and activities with specific examples

Design the graduated enforcement process

Implement the ECTA notice-and-takedown procedure

Deploy and integrate with your Terms of Service

Frequently Asked Questions

What is an Acceptable Use Policy and why does my platform need one?

Can I immediately terminate a user's account for violating the AUP?

What are my reporting obligations under the Cybercrimes Act?

How does ECTA's notice-and-takedown procedure work?

Should the AUP be a separate document or part of the Terms of Service?

How should hate speech be defined in a South African AUP?

What content moderation approach should I use?

How should I handle content that is legal in South Africa but violates community standards?

What happens if I fail to remove illegal content after being notified?

How should the AUP address data scraping and automated access?

Do I need an appeals process for AUP enforcement actions?

How often should I update the Acceptable Use Policy?

What You Get With This Template

You May Also Need

Be First to Draft Your Acceptable Use Policy

Acceptable Use Policy
Template — South Africa