Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998
26
No. 37067
GOVERNMENT GAZETTE, 26 November 2013
Act No. 4 of 2013
Protection of Personal Information Act, 2013
26
(c) collection of the information from another source would not prejudice a
legitimate interest of the data subject;
(d) collection of the information from another source is necessary—
(i) to avoid prejudice to the maintenance of the law by any public body,
including the prevention, detection, investigation, prosecution and 5
punishment of offences;
(ii) to comply with an obligation imposed by law or to enforce legislation
concerning the collection of revenue as defined in section 1 of the South
African Revenue Service Act, 1997 (Act No. 34 of 1997);
(iii) for the conduct of proceedings in any court or tribunal that have 10
commenced or are reasonably contemplated;
(iv) in the interests of national security; or
(v) to maintain the legitimate interests of the responsible party or of a third
party to whom the information is supplied;
(e) compliance would prejudice a lawful purpose of the collection; or
15
(f) compliance is not reasonably practicable in the circumstances of the particular
case.
Condition 3
Purpose specification
Collection for specific purpose
20
13. (1) Personal information must be collected for a specific, explicitly defined and
lawful purpose related to a function or activity of the responsible party.
(2) Steps must be taken in accordance with section 18(1) to ensure that the data
subject is aware of the purpose of the collection of the information unless the provisions
of section 18(4) are applicable.
25
Retention and restriction of records
14. (1) Subject to subsections (2) and (3), records of personal information must not be
retained any longer than is necessary for achieving the purpose for which the
information was collected or subsequently processed, unless—
(a) retention of the record is required or authorised by law;
(b) the responsible party reasonably requires the record for lawful purposes
related to its functions or activities;
(c) retention of the record is required by a contract between the parties thereto; or
(d) the data subject or a competent person where the data subject is a child has
consented to the retention of the record.
(2) Records of personal information may be retained for periods in excess of those
contemplated in subsection (1) for historical, statistical or research purposes if the
responsible party has established appropriate safeguards against the records being used
for any other purposes.
(3) A responsible party that has used a record of personal information of a data subject
to make a decision about the data subject, must—
(a) retain the record for such period as may be required or prescribed by law or a
code of conduct; or
(b) if there is no law or code of conduct prescribing a retention period, retain the
record for a period which will afford the data subject a reasonable opportunity,
taking all considerations relating to the use of the personal information into
account, to request access to the record.
(4) A responsible party must destroy or delete a record of personal information or
de-identify it as soon as reasonably practicable after the responsible party is no longer
authorised to retain the record in terms of subsection (1) or (2).
30
35
40
45
50