Data Protection in South Africa

Transfer in South Africa

POPIA caters for two scenarios relating to the transfer of personal information, namely where a responsible party in South Africa sends personal information to another country to be processed and where a responsible party in South Africa processes personal information that has been received from outside South Africa.

Receiving personal information from other countries

The requirements for the processing of personal information prescribed in POPIA will apply to any personal information processed in South Africa, irrespective of its origin.

Sending personal information to other countries for processing

A responsible party in South Africa may not transfer personal information to a third party in another country unless:

  • The recipient is subject to a law, binding corporate rules or a binding agreement which:
    • Upholds principles for reasonable processing of the information that are substantially similar to the conditions contained in POPIA; and
    • Includes provisions that are substantially similar to those contained in POPIA relating to the further transfer of personal information from the recipient to third parties who are in another country;
  • The data subject consents to the transfer;
  • The transfer is necessary for the performance of a contract between the data subject and responsible party, or for the implementation of pre-contractual measures taken in response to the data subject’s request; or
  • The transfer is necessary for the performance of a contract between the data subject and responsible party, or for the implementation of pre-contractual measures taken in response to the data subject’s request; or
  • The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the responsible party and a third party, or the transfer is for the benefit of the data subject and:
    • It is not reasonably practicable to obtain the consent of the data subject to that transfer; and
    • If it were reasonably practicable to obtain such consent, the data subject would be likely to give it.

Continue reading

  • no results

Previous topic
Back to top