Border control at South African airports: what happens to travellers and their data

Arriving: the steps at the border

The Border Management Authority (BMA) handles the movement of people and goods through South Africa's ports of entry. Its work covers immigration, port health, biosecurity, access control and law enforcement ⁶. In October 2023 the BMA said it managed 72 ports of entry ⁵. A government report in January 2024 counted 71: 52 land ports, 10 international airports and 9 seaports ⁶. The two sources give different totals.

Travellers who arrive with an ETA are checked by face. The minister said at the launch that travellers are verified by face again on arrival and at departure, and that the system flags overstays in real time ².

Passengers in transit through four named South African airports do not need a transit visa. The Department of Home Affairs says they are captured biometrically ¹.

Officers refuse entry to people without valid documents. Over the 2023 to 2024 festive period the BMA processed 5,096,288 travellers. It denied entry to 6,455 people it classed as undesirable and refused about 4,626 for invalid passports, fraudulent visas or missing yellow fever certificates ⁶.

Entry permission: visa exemptions and the ETA

The Department of Home Affairs publishes a list of countries whose citizens can visit without a visa. The version issued on 9 December 2025 allows 90 days for countries such as Australia, Canada, Germany, Japan, the UK and the US. It allows 30 days for countries such as Algeria, Egypt, Jordan and Peru. The page says the exemptions can change without notice ¹.

Ordinary passport holders from Pakistan and Bangladesh have needed a port of entry or transit visa to pass through South Africa since 1 August 2022 ¹.

South Africa first announced an e-Visa pilot in New Zealand in September 2018 ¹⁴. A 2022 Home Affairs plan said the e-Visa tourist module was active in 14 countries, including China, India, Kenya and Nigeria ⁷.

The ETA launched on 12 August 2026. A pilot during South Africa's G20 Presidency covered travellers from China, India, Indonesia and Mexico. The ETA is to become compulsory in stages for short visits from countries that need port-of-entry visas. Visa-exempt travellers may use it by choice ².

Applicants register at eta.dha.gov.za, confirm their phone and email with a one-time PIN, scan their passport, upload a selfie and pay. An automated risk analysis follows. The minister said the system checks a passport against more than forty points to test whether it is genuine. He gave figures of 216,204 applications processed and 6,126 fraudulent applications rejected since the pilot began. The launch speech did not state the fee ². Before launch the minister said the ETA would replace paper visas, which he linked to corruption and fraud ⁴.

The first ports were OR Tambo, Cape Town, King Shaka and Lanseria airports, with land and sea ports to follow ². An April 2026 report said the ETA was in full use for all eligible countries. The portal still listed only China, India, Indonesia and Mexico at that time ³.

Biometrics and eGates

In 2022 Home Affairs said it was building a Biometric Movement Control System (BMCS) to capture fingerprints and face data from all travellers entering or leaving South Africa. The plan named 34 ports, including OR Tambo, Cape Town, King Shaka and Lanseria airports. No date was given ⁷.

The BMA has used the BMCS in practice. In January 2024 it said it took fingerprints from people it intercepted and recorded them in the system. It credited the BMCS with a higher detection rate of people it classed as undesirable ⁶.

The same 2022 plan described an eGate pilot at Cape Town International Airport for South African passport holders. The gate checks the traveller's biometrics, tests the passport, checks the BMCS risk engine and records the movement ⁷.

The ETA adds a face check before travel. The selfie is matched against the passport photo. The minister said that the face of the traveller becomes the key that decides entry ².

Passenger data: API and PNR

South Africa uses interactive Advance Passenger Information (API). A 2019 Home Affairs presentation to ICAO said the system had run for about 10 years. It took data from about 40 airlines covering about 12 million passengers, and could accept or deny a passenger before boarding ⁸.

The Department of Home Affairs is the custodian of the API system. API data is shared with the police and State Security. A 24-hour operations centre checks every hit. Airlines that fail to comply face penalties ⁸.

Passenger Name Record (PNR) use was still a plan in 2022. The Home Affairs plan said a new PNR system would flag unknown threats from passenger profiles, and advance passenger processing would flag known suspects such as people on watch lists ⁷.

Airlines file a separate passenger manifest with the South African Revenue Service for air passenger tax. Rule 47B.09 asks for each passenger's name, airports, luggage weight, seat and check-in status, filed electronically through SARS systems ¹⁵.

Watch lists and checks

The API system runs built-in business rules and risk analysis. Home Affairs said results can be shared with other states ⁸. The BMCS risk engine is part of the eGate check ⁷.

Among the 6,455 travellers refused as undesirable in the 2023 to 2024 festive period were people wanted under Interpol red notices ⁶. The BMA Act requires vetting and regular lifestyle audits of border officials, the BMA Commissioner wrote in 2023 ⁵.

Your data: the law and how to ask for records

The Protection of Personal Information Act 4 of 2013 (POPIA) governs how personal information is handled. The Information Regulator, set up under section 39 of POPIA, enforces it and the Promotion of Access to Information Act 2 of 2000 (PAIA). The Regulator answers to the National Assembly ¹¹.

Under section 23 of POPIA a person who proves their identity can ask whether a body holds their information, free of charge. They can ask for a copy or description of it and the names of third parties who had access. A prescribed fee may apply for the copy. Refusals follow the grounds in PAIA ⁹.

POPIA does not apply to processing by public bodies that involves national security, defence or public safety. It does not apply to crime prevention, detection and prosecution where other laws set adequate safeguards ¹⁰. These exclusions can cover border security work.

We could not find a published retention period for Home Affairs or BMA border records as of 19 October 2026. Complaints go to the Information Regulator, which lists contact details and forms on its website ¹¹.

Who runs the systems

The Department of Home Affairs sets immigration policy and runs visas, the ETA and the API system ^2,8. The BMA became an autonomous Schedule 3A public entity on 1 April 2023. President Cyril Ramaphosa launched it formally on 5 October 2023 in Musina. Its Commissioner is Dr Michael Masiapato ⁵.

The sources we opened did not name private contractors for the ETA, BMCS or API systems.

Security screening on departure

The South African Civil Aviation Authority (SACAA) regulates aviation security under the Civil Aviation Act 13 of 2009, the Civil Aviation Regulations of 2011 and the National Aviation Security Programme. The programme follows ICAO Annex 17 ¹².

SACAA approves screening organisations and certifies screeners under Part 110 of the regulations. It sets minimum specifications for screening equipment, and equipment must be approved before purchase ¹².

For non-scheduled commercial flights, regulation 114.05.2 requires departing, transfer and transit passengers and their cabin bags to be screened before they enter a security restricted area or board ¹³.

Liquids in cabin bags must be in containers of 100 ml or less, packed in one clear resealable bag of up to 1 litre per passenger ¹².