South African Cyber Law
Lawful Processing of Personal Information
POPIA requires processing of personal information to comply with the Act's conditions for lawful processing, subject to the provisions and exceptions in the Act.
The eight conditions
The eight conditions are accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.
These conditions address different stages of the information lifecycle, from deciding whether information may be collected to how it is secured and how the person concerned can participate.
Consent is not the entire framework
Consent is one lawful basis recognised by POPIA, but POPIA does not reduce lawful processing to a simple consent-only model.
Other grounds and statutory requirements can apply depending on the circumstances and purpose of processing.
Purpose and minimisation
Information should be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party.
Processing limitation also addresses the collection of information that is adequate, relevant and not excessive in relation to the purpose.
Keep the context
Whether processing is lawful depends on the circumstances, the purpose, the type of information and the applicable provisions of POPIA.
A privacy notice or consent form should not be treated as proof that every subsequent use of information is automatically lawful.
Official source
Read the official legislation from the South African government:
Protection of Personal Information Act 4 of 2013 — South African Department of JusticeImportant
Cyber Conduct provides general educational information, not legal advice. South African legislation can change, and the application of the law depends on the facts of each situation. For a specific legal matter, consider obtaining advice from a qualified legal professional or the relevant authority.