South AfricaProtection of Personal Information Act, cross-border transfer
POPIA, s. 72 (transfer of personal information outside the Republic)
In force since .
A cross border transfer rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Transfer, Licensing
- Audit expectation
- none
What it requires
- Before transferring personal information outside South Africa, confirm the recipient country, its binding rules, or an agreement provides an adequate level of protection substantially similar to the Act's conditions, or that another listed transfer ground, such as the data subject's consent, applies.
- Obtain the Information Regulator's prior authorisation before transferring special personal information, or a child's personal information, to a country that does not provide an adequate level of protection.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 72 conditions a transfer abroad on an adequacy finding, the data subject's consent, a contract need or the data subject's benefit. It asks for no log or record of a transfer. The prior authorisation the row mentions for special personal information and a child's information sits in sections 57 and 58, which this row does not cite. The hook rests on the opening words of section 72(1), which govern a responsible party in the Republic.
- Kind
- None
- As of
What this law does
Section 72(1) bars a responsible party in the Republic from transferring personal information about a data subject to a third party in a foreign country unless the recipient is subject to a law, binding corporate rules, or a binding agreement that effectively upholds substantially similar processing conditions and substantially similar onward-transfer restrictions, or unless the data subject consents, the transfer is necessary to perform a contract with or for the benefit of the data subject, or the transfer benefits the data subject and consent is not reasonably practicable to obtain but would likely be given.
Section 57(1)(d) separately requires a responsible party to obtain the Information Regulator's prior authorisation before transferring special personal information, or a child's personal information, to a country that does not provide an adequate level of protection.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .