"Processing" of information is defined in POPIA as any operation or activity or any set of operations, whether or not by automatic means,concerning personal information, including:

• The collection, receipt, recording, organization, collation, storage, updating or modification, retrieval, alteration, consultation or use;
• Dissemination by means of transmission, distribution or making available in any other form; and
• Merging, linking, as well as blocking, degradation, erasure or destruction of information.

POPIA prescribes the following eight conditions for lawful processing of personal information:

• Accountability: The responsible party must comply with all the conditions for lawful processing.
• Purpose specification: Personal information must only be collected for a specific, explicitly defined lawful purpose related to a function or activity of the responsible party.
• Processing limitation: Processing must be justified on a ground recognized under POPIA (e.g. consent / legitimate interests of the data subject, responsible party or the third party to whom the information is supplied).
• Further processing limitation: Processing must be in accordance with or compatible with the purpose for which it was initially collected subject to limited exceptions.
• Information quality: Steps must be taken to ensure that the information is complete, accurate, not misleading and updated where necessary.
• Openness: Notification requirements must be complied with when collecting personal information.
• Security safeguards: Appropriate, reasonable technical and organizational measures must be implemented and maintained to prevent loss of, damage to or unauthorized destruction of or unlawful access to personal information.
• Data subject participation: Data subjects have the right to request details of the personal information that a responsible party holds about them and, in certain circumstances, request access to such information.