Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998
28
No. 37067
GOVERNMENT GAZETTE, 26 November 2013
Act No. 4 of 2013
Protection of Personal Information Act, 2013
28
(5) The destruction or deletion of a record of personal information in terms of
subsection (4) must be done in a manner that prevents its reconstruction in an intelligible
form.
(6) The responsible party must restrict processing of personal information if—
(a) its accuracy is contested by the data subject, for a period enabling the 5
responsible party to verify the accuracy of the information;
(b) the responsible party no longer needs the personal information for achieving
the purpose for which the information was collected or subsequently
processed, but it has to be maintained for purposes of proof;
(c) the processing is unlawful and the data subject opposes its destruction or 10
deletion and requests the restriction of its use instead; or
(d) the data subject requests to transmit the personal data into another automated
processing system.
(7) Personal information referred to in subsection (6) may, with the exception of
storage, only be processed for purposes of proof, or with the data subject’s consent, or 15
with the consent of a competent person in respect of a child, or for the protection of the
rights of another natural or legal person or if such processing is in the public interest.
(8) Where processing of personal information is restricted pursuant to subsection (6),
the responsible party must inform the data subject before lifting the restriction on
processing.
20
Condition 4
Further processing limitation
Further processing to be compatible with purpose of collection
15. (1) Further processing of personal information must be in accordance or
compatible with the purpose for which it was collected in terms of section 13.
(2) To assess whether further processing is compatible with the purpose of collection,
the responsible party must take account of���
(a) the relationship between the purpose of the intended further processing and
the purpose for which the information has been collected;
(b) the nature of the information concerned;
(c) the consequences of the intended further processing for the data subject;
(d) the manner in which the information has been collected; and
(e) any contractual rights and obligations between the parties.
(3) The further processing of personal information is not incompatible with the
purpose of collection if—
(a) the data subject or a competent person where the data subject is a child has
consented to the further processing of the information;
(b) the information is available in or derived from a public record or has
deliberately been made public by the data subject;
(c) further processing is necessary—
(i) to avoid prejudice to the maintenance of the law by any public body
including the prevention, detection, investigation, prosecution and
punishment of offences;
(ii) to comply with an obligation imposed by law or to enforce legislation
concerning the collection of revenue as defined in section 1 of the South
African Revenue Service Act, 1997 (Act No. 34 of 1997);
(iii) for the conduct of proceedings in any court or tribunal that have
commenced or are reasonably contemplated; or
(iv) in the interests of national security;
(d) the further processing of the information is necessary to prevent or mitigate a
serious and imminent threat to—
(i) public health or public safety; or
(ii) the life or health of the data subject or another individual;
25
30
35
40
45
50