Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998
24
No. 37067
GOVERNMENT GAZETTE, 26 November 2013
Act No. 4 of 2013
Protection of Personal Information Act, 2013
24
determination of the purpose and means of the processing and during the processing
itself.
Condition 2
Processing limitation
Lawfulness of processing
5
9. Personal information must be processed—
(a) lawfully; and
(b) in a reasonable manner that does not infringe the privacy of the data subject.
Minimality
10. Personal information may only be processed if, given the purpose for which it is 10
processed, it is adequate, relevant and not excessive.
Consent, justification and objection
11. (1) Personal information may only be processed if—
(a) the data subject or a competent person where the data subject is a child
consents to the processing;
(b) processing is necessary to carry out actions for the conclusion or performance
of a contract to which the data subject is party;
(c) processing complies with an obligation imposed by law on the responsible
party;
(d) processing protects a legitimate interest of the data subject;
(e) processing is necessary for the proper performance of a public law duty by a
public body; or
(f) processing is necessary for pursuing the legitimate interests of the responsible
party or of a third party to whom the information is supplied.
(2) (a) The responsible party bears the burden of proof for the data subject’s or
competent person’s consent as referred to in subsection (1)(a).
(b) The data subject or competent person may withdraw his, her or its consent, as
referred to in subsection (1)(a), at any time: Provided that the lawfulness of the
processing of personal information before such withdrawal or the processing of personal
information in terms of subsection (1)(b) to (f) will not be affected.
(3) A data subject may object, at any time, to the processing of personal information—
(a) in terms of subsection (1)(d) to (f), in the prescribed manner, on reasonable
grounds relating to his, her or its particular situation, unless legislation
provides for such processing; or
(b) for purposes of direct marketing other than direct marketing by means of
unsolicited electronic communications as referred to in section 69.
(4) If a data subject has objected to the processing of personal information in terms of
subsection (3), the responsible party may no longer process the personal information.
15
20
25
30
35
Collection directly from data subject
12. (1) Personal information must be collected directly from the data subject, except 40
as otherwise provided for in subsection (2).
(2) It is not necessary to comply with subsection (1) if—
(a) the information is contained in or derived from a public record or has
deliberately been made public by the data subject;
(b) the data subject or a competent person where the data subject is a child has 45
consented to the collection of the information from another source;