South AfricaProtection of Personal Information Act, special personal information and children
POPIA, ss. 26-35 (special personal information and children)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Do not process special personal information, including a person's biometric information, health, race, or political persuasion, unless a listed ground under sections 27 to 33 applies.NIST Privacy FrameworkCT.PO-P1
- Do not process a child's personal information unless a competent person has given prior consent, another listed ground in section 35(1) applies, or the Information Regulator has authorised the processing as being in the public interest with appropriate safeguards.NIST Privacy FrameworkCT.PO-P1
- Where you rely on a special-category authorisation for a data subject's religious belief, trade union membership, or political persuasion, do not supply that information to a third party without the data subject's consent.NIST Privacy FrameworkCT.PO-P1
- Only process a data subject's biometric information or record of criminal behaviour where you are a body charged with applying criminal law or you obtained the information lawfully, and put appropriate safeguards in place before relying on any special personal information exception.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 26 to 35 prohibit processing special personal information and a child's personal information unless a listed ground applies, or in a child's case the Regulator authorises it by Gazette notice with safeguards. Read through, they ask the responsible party for no log, register or proof of the ground relied on, and give the Regulator no power to demand one.
- Kind
- None
- As of
What this law does
Section 26 prohibits processing personal information about a data subject's religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information (a term the Act's definitions extend to fingerprinting, DNA analysis, retinal scanning and voice recognition), or their alleged criminal behaviour or related proceedings, unless section 27 applies.
Section 27 lifts the prohibition where the data subject consents, the processing is necessary to establish or defend a legal right, historical or research purposes apply, the information was deliberately made public by the data subject, or sections 28 to 33 authorise it for a specific category; sections 28 to 32 set narrower authorisations for religious bodies, race-based redress measures, trade unions, political organisations, and health or insurance processing, each barring disclosure to a third party without the data subject's consent, and section 33 authorises processing criminal-behaviour or biometric information by bodies charged with applying criminal law or by a responsible party that obtained it lawfully.
Section 34 separately prohibits processing a child's personal information unless section 35 applies, and section 35(1) permits it only with a competent person's prior consent, to establish or defend a legal right, to comply with international law, for historical or research purposes, or where the child made the information public with a competent person's consent; the Regulator may also authorise processing of a child's information in the public interest under section 35(2), subject to conditions safeguarding the child under section 35(3).
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .