Processes personal data, in South Africa

National Health Act 61 of 2003, ss. 14-17 (confidentiality of user information and protection of health records) · Read the law's page

• Treat all information about a user of health services, including health status, treatment and stay in a health establishment, as confidential, and disclose it only with the user's written consent, where a court order or law requires it, or where non-disclosure is a serious threat to public health.
• If you are in charge of a health establishment that holds users' health records, set up control measures that prevent unauthorised access to the records and to the storage facility or system in which they are kept.

National Credit Act 34 of 2005, ss. 43, 68, 70 and 72 (credit bureaux) · Read the law's page

• Register as a credit bureau before you offer or conduct business as one, or hold yourself out as authorised to offer any service customarily offered by a credit bureau.
• Protect the confidentiality of the consumer information you receive, compile, retain or report, use it only for a purpose the Act, other national legislation or applicable provincial legislation permits, and release it only to the consumer, as the law permits or requires, as the consumer instructs, or by order of a court or the Tribunal.
• Take reasonable steps to verify the accuracy of the consumer credit information reported to you, and do not knowingly or negligently provide a report that contains inaccurate information.
• Accept without charge the consumer's own filing of consumer credit information to correct or challenge what you hold about that consumer, and promptly expunge any prescribed information that is not permitted in your records.
• Receive, compile and report only consumer credit information the Act or the regulations allow, and receive it only from the persons the regulations prescribe.
• Let a person inspect their file without charge once within any period of twelve months, and when a person challenges information you hold, seek evidence for it and, within the prescribed time, provide the evidence or remove the information and all record of it.
• Do not report information that a person has challenged until the challenge has been resolved.

POPIA, s. 22 (notification of security compromises) · Read the law's page

• Notify the Information Regulator of a security compromise as soon as reasonably possible after discovering that personal information has been accessed or acquired by an unauthorised person; the Act sets no fixed hour or day limit, only this standard.
• Notify the affected data subject of the same security compromise as soon as reasonably possible after discovery, in writing, unless a law-enforcement body or the Regulator determines that notifying would impede a criminal investigation, or the data subject's identity cannot be established.
• In the notification to the data subject, describe the compromise's likely consequences, the measures you have taken or intend to take to address it, a recommendation of what the data subject should do, and, if known, the identity of the unauthorised person.
• As an operator, notify the responsible party immediately once you have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person.

POPIA, s. 72 (transfer of personal information outside the Republic) · Read the law's page

• Before transferring personal information outside South Africa, confirm the recipient country, its binding rules, or an agreement provides an adequate level of protection substantially similar to the Act's conditions, or that another listed transfer ground, such as the data subject's consent, applies.
• Obtain the Information Regulator's prior authorisation before transferring special personal information, or a child's personal information, to a country that does not provide an adequate level of protection.

POPIA, ss. 18, 23-25 and 69-70 (the information notice, access and correction, and direct marketing) · Read the law's page

• Before or when you collect personal information, tell the data subject what is being collected and its source, your identity, the purpose of collection, whether supplying it is voluntary or mandatory, any intended transfer to another country, and their rights of access, correction, objection and complaint to the Information Regulator.
• On request, confirm free of charge whether you hold a data subject's personal information, and give access to the record within a reasonable time, in a reasonable manner and an understandable form.
• Correct or delete personal information a data subject shows is inaccurate, irrelevant, out of date, incomplete, misleading or unlawfully obtained, and tell the data subject what action you took.
• Do not process personal information for direct marketing by electronic communication unless the data subject has consented, or is an existing customer given a free and simple chance to opt out at collection and on every marketing contact afterward.
• Give a person listed in a public subscriber directory a free opportunity to object to the use of their personal information before including it.

POPIA, ss. 26-35 (special personal information and children) · Read the law's page

• Do not process special personal information, including a person's biometric information, health, race, or political persuasion, unless a listed ground under sections 27 to 33 applies.
• Do not process a child's personal information unless a competent person has given prior consent, another listed ground in section 35(1) applies, or the Information Regulator has authorised the processing as being in the public interest with appropriate safeguards.
• Where you rely on a special-category authorisation for a data subject's religious belief, trade union membership, or political persuasion, do not supply that information to a third party without the data subject's consent.
• Only process a data subject's biometric information or record of criminal behaviour where you are a body charged with applying criminal law or you obtained the information lawfully, and put appropriate safeguards in place before relying on any special personal information exception.

POPIA, ss. 39-54 and 73-109 (the Information Regulator, enforcement, civil remedies, offences and administrative fines) · Read the law's page

• Expect the Information Regulator to investigate a complaint that you have interfered with the protection of personal information, including by entering and searching your premises under a warrant where a judge or magistrate is satisfied there are reasonable grounds.
• Comply with an enforcement notice the Regulator serves requiring you to take, or stop taking, specified steps, or appeal it to the High Court within 30 days.
• Expect a data subject, or the Regulator at the data subject's request, to be able to bring a civil damages claim against you for breach of any provision of the Act, regardless of intent or negligence.
• Expect prosecution and a fine or imprisonment of up to ten years for the most serious offences, such as unlawfully selling a data subject's account number, and up to twelve months for lesser offences such as breaching confidentiality.
• Expect an administrative fine of up to R10 million by infringement notice, which the Regulator sets after considering the nature of the information involved, the number of data subjects affected, and whether you could have prevented the contravention.

Protection of Personal Information Act 4 of 2013 (POPIA), ss. 1-21, 36-38 and 55-59 (application, the general conditions for lawful processing, exemptions, the Information Officer and prior authorisation) · Read the law's page

• Obtain a lawful basis, such as the data subject's consent, before processing personal information, and limit processing to the purpose for which it was collected.
• Secure the integrity and confidentiality of personal information in your possession with appropriate technical and organisational measures, identify the foreseeable risks to it, and keep those measures updated as risks change.
• Where an operator processes personal information on your behalf, bind it by written contract to the same security measures, and require it to notify you immediately if it has reasonable grounds to believe the information was accessed or acquired by an unauthorised person.
• Do not retain a record of personal information longer than the purpose for which it was collected requires, and destroy, delete, or de-identify it as soon as reasonably practicable once you are no longer authorised to keep it.
• Register your information officer with the Information Regulator before that officer takes up duties under the Act.
• Obtain the Information Regulator's prior authorisation before linking data subjects' unique identifiers across responsible parties, processing criminal-behaviour or credit-reporting information, or transferring special personal information or a child's information to a country without adequate protection.

Regulations Relating to the Protection of Personal Information, 2018, regulation 7 (complaints) and the administrative fines regulation, as amended by Government Notice 6126 of 17 April 2025 · Read the law's page

• Expect the Information Regulator to accept a complaint that you have interfered with the protection of a data subject's personal information on its Form 5, and to acknowledge it with a reference number within fourteen days.
• If you are served an infringement notice for an administrative fine that you cannot pay in a lump sum, you may arrange with the Regulator to pay it in instalments, case by case.

Regulations Relating to the Protection of Personal Information, 2018, regulations 2 and 3, as substituted by Government Notice 6126 of 17 April 2025 · Read the law's page

• Accept a data subject's objection to the processing of their personal information at any time during your office hours and free of charge, on a form substantially similar to Form 1 that is reasonably accessible by hand, fax, post, email, SMS or WhatsApp.
• When you collect personal information, tell the data subject that they have the right to object to its processing.
• Record electronically an objection made by telephone, and make the recording available to the data subject on request, including as a transcription.
• Accept a data subject's request for the correction or deletion of personal information, or for the destruction or deletion of a record of it, at any time and free of charge, on a form substantially similar to Form 2 that is reasonably accessible by hand, fax, post, email, SMS or WhatsApp message; record a request made by telephone and make the recording available on request, free of charge.
• Notify the data subject in writing of the action taken on a correction or deletion request within thirty days of receipt of the outcome of the request.