In South Africa, privacy rights and information protection is provided for by the Protection of Personal Information Act 4 of 2013 (POPIA), which came into effect on 19 November 2013, with most of its substantive provisions coming into force from 1 July 2021. POPIA safeguards the constitutional right to privacy by protecting personal information that is processed by a “responsible party,” while at the same time maintaining the right to access information. Generally speaking, POPIA regulates the circumstances where a responsible party in South Africa transfers personal information about a data subject to a third party.

A “responsible party” under POPIA, is any public or private body that determines the purpose of and means for processing personal information. To be clear, the processing of personal information includes collecting, receiving, recording and using information. Furthermore, POPIA defines a “data subject” as a person to whom the personal information relates. Under POPIA, juristic as well as natural persons can be data subjects.

Export of data

The basis for enforcement of data protection laws is to protect the public against data breaches, both domestically and internationally. Many South African organizations transfer data both locally and abroad. Cross-border data transfers occur, for instance, where personal information is sent outside of South Africa to a customer, client, service provider or sub-contractor, or when making use of cloud storage hosted outside South African borders. Section 72 of POPIA sets out the requirements for the export of data while ensuring that the data is subject to adequate legal protection.

In particular, section 72 states that a responsible party may only transfer personal information to a third party that is in a foreign country if certain protections are in place. To provide personal information abroad, one of the following protections must be present:

• Adequate legal protection: The cross-border recipient of the personal information is subject to a law, corporate rules or an agreement  that provides an adequate level of protection that effectively upholds the principles for reasonable processing. The law, corporate rules or agreement should include provisions that are (i) substantially similar to the conditions for the lawful processing of personal information in South Africa, and (ii) substantially similar to section 72 of POPIA, relating to the further transfer of personal information from the recipient to third parties that are in a foreign country.
• Consent: The data subject consents  to the transfer of personal information.
• Necessary for the performance of a contract: The transfer of personal information is necessary for the performance of a contract between the data subject and the responsible party, or to implement pre-contractual measures taken in response to a data subject’s request.
• Interests of the data subject: The transfer of personal information is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the responsible party and a third party.
• Benefit of the data subject: The transfer of personal information is for the benefit of the data subject in circumstances where (i) it is not reasonably practicable to obtain the consent of the data subject for the transfer, and (ii) if it were reasonably practicable, the data subject would be likely to give consent.

Generally, it is easier and more convenient to effect cross-border data transfers to a country with laws that provide an adequate level of protection as well as processing principles that are substantially similar to the conditions for lawful processing of personal information under POPIA, as opposed to situations where there are no such laws and so provision for data protection is made by way of binding corporate rules or agreement.

As indicated above, POPIA allows for the export of personal data to countries that have laws providing an adequate level of protection for personal information. That said, POPIA does not specify those countries, nor does it create a mechanism for any regulatory recognition of such countries. The onus is on the responsible party to conduct an analysis of the adequacy of legislation in the countries to which the data will be exported.

Section 57(1) of POPIA provides that if “special personal information” (i.e. religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life or biometric information) or the personal information of children is to be transferred to a third party in a country that does not provide an adequate level of protection, the responsible party is required to obtain prior authorization from the Information Regulator before any processing may take place.

Import of data

As indicated above, POPIA regulates cross-border data transfers in instances where a responsible party in South Africa sends personal information to be processed in another country. In addition, POPIA also applies when a responsible party in another country sends personal information to South Africa for processing. POPIA applies to all personal information processed in South Africa, irrespective of the location of the data subject.

For example, if a South African registered company processes data that is exported to South Africa from Europe, that company must comply with POPIA when processing the information (and as a general proposition, the exporter of the data must also have due regard to the requirements of the European General Data Protection Regulation (GDPR)).

As can be seen, South Africa’s policies and procedures for cross-border transfers of personal data are similar to that of European countries where the GDPR finds application. However, in certain instances POPIA operates so as to place a positive obligation on the responsible party to conduct an analysis on the adequacy of the legislation in the countries to which it intends exporting data. We note that the failure to comply with POPIA could put the responsible party at risk of penalties, including fines and imprisonment.  Accordingly, it is important for anyone who processes personal data to be familiar with POPIA in order to stay compliant.