Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998
18
No. 37067
GOVERNMENT GAZETTE, 26 November 2013
Act No. 4 of 2013
Protection of Personal Information Act, 2013
18
(a) entered in a record by or for a responsible party by making use of automated
or non-automated means: Provided that when the recorded personal information is processed by non-automated means, it forms part of a filing system or
is intended to form part thereof; and
(b) where the responsible party is—
(i) domiciled in the Republic; or
(ii) not domiciled in the Republic, but makes use of automated or
non-automated means in the Republic, unless those means are used only
to forward personal information through the Republic.
(2) (a) This Act applies, subject to paragraph (b), to the exclusion of any provision of
any other legislation that regulates the processing of personal information and that is
materially inconsistent with an object, or a specific provision, of this Act.
(b) If any other legislation provides for conditions for the lawful processing of
personal information that are more extensive than those set out in Chapter 3, the
extensive conditions prevail.
(3) This Act must be interpreted in a manner that—
(a) gives effect to the purpose of the Act set out in section 2; and
(b) does not prevent any public or private body from exercising or performing its
powers, duties and functions in terms of the law as far as such powers, duties
and functions relate to the processing of personal information and such
processing is in accordance with this Act or any other legislation, as referred
to in subsection (2), that regulates the processing of personal information.
(4) ‘‘Automated means’’, for the purposes of this section, means any equipment
capable of operating automatically in response to instructions given for the purpose of
processing information.
5
10
15
20
25
Lawful processing of personal information
4. (1) The conditions for the lawful processing of personal information by or for a
responsible party are the following:
(a) ‘‘Accountability’’, as referred to in section 8;
(b) ‘‘Processing limitation’’, as referred to in sections 9 to 12;
(c) ‘‘Purpose specification’’, as referred to in sections 13 and 14;
(d) ‘‘Further processing limitation’’, as referred to in section 15;
(e) ‘‘Information quality’’, as referred to in section 16;
(f) ‘‘Openness’’, as referred to in sections 17 and 18;
(g) ‘‘Security safeguards’’, as referred to in sections 19 to 22; and
(h) ‘‘Data subject participation’’, as referred to in sections 23 to 25.
(2) The conditions, as referred to in subsection (1), are not applicable to the
processing of personal information to the extent that such processing is—
(a) excluded, in terms of section 6 or 7, from the operation of this Act; or
(b) exempted in terms of section 37 or 38, from one or more of the conditions
concerned in relation to such processing.
(3) The processing of the special personal information of a data subject is prohibited
in terms of section 26, unless the—
(a) provisions of sections 27 to 33 are applicable; or
(b) Regulator has granted an authorisation in terms of section 27(2),
in which case, subject to section 37 or 38, the conditions for the lawful processing of
personal information as referred to in Chapter 3 must be complied with.
(4) The processing of the personal information of a child is prohibited in terms of
section 34, unless the—
(a) provisions of section 35(1) are applicable; or
(b) Regulator has granted an authorisation in terms of section 35(2),
in which case, subject to section 37, the conditions for the lawful processing of personal
information as referred to in Chapter 3 must be complied with.
(5) The processing of the special personal information of a child is prohibited in terms
of sections 26 and 34 unless the provisions of sections 27 and 35 are applicable in which
30
35
40
45
50
55