Definition of personal data

"Personal information" is defined in POPIA as information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing, juristic person, including:

• Information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin; color, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief; culture, language and birth of the person;
• Information relating to the education, medical, financial, criminal or employment history of the person;
• Any identifying number, symbol, email address, physical address, telephone number, location information, online identifier or other particular assignment to the person;
• The biometric information of the person;
• The personal opinions, views or preferences of the person;
• Correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
• The views or opinions of another individual about the person; and
• The name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

POPIA applies to the processing of personal information entered in a record by or for a responsible party / data controller that is domiciled in South Africa and that makes use of automated or non-automated means to process the personal information. It would also apply if the responsible party is not domiciled in South Africa but makes use of automated or non-automated means in South Africa unless those means are used only to forward personal information through South Africa.

POPIA does not apply to the processing of personal information:

• In the course of a purely personal or household activity;
• That has been de-identified to the extent that it cannot be re-identified again;
• By or on behalf of the State with regard to national security, defense or public safety, or the prevention, investigation or proof of offenses; or for the purposes of the prosecution of offenders or the execution of sentences or security measures, to the extent that adequate safeguards have been established in specific legislation for the protection of such personal information;
• For exclusively journalistic purposes by responsible parties who are subject to, by virtue of office, employment or profession, a code of ethics that provides adequate safeguards for the protection of personal information;
• Solely for the purposes of journalistic, literary or artistic expression to the extent that such exclusion is necessary to reconcile, as a matter of public interest, the right to privacy with the right to freedom of expression;
• By Cabinet and its committees, the Executive Council of a province and a Municipal Council of a municipality;
• For purposes relating to the judicial functions of a court referred to in section 166 of the Constitution; and
• Under circumstances that have been exempted from the application of the conditions for lawful processing by the Information Regulator in certain circumstances.

Definition of sensitive personal data

Special personal information is information concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information and criminal behavior (to the extent that such information relates to the alleged commission of an offense or any proceedings in respect of any offence allegedly committed, or the disposal of such proceedings).

Subject to certain prescribed exceptions, the processing of special personal information without the consent of the data subject is generally prohibited under POPIA.