Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998
78
No. 37067
GOVERNMENT GAZETTE, 26 November 2013
Act No. 4 of 2013
Protection of Personal Information Act, 2013
78
(ii) includes provisions, that are substantially similar to this section, relating
to the further transfer of personal information from the recipient to third
parties who are in a foreign country;
(b) the data subject consents to the transfer;
(c) the transfer is necessary for the performance of a contract between the data 5
subject and the responsible party, or for the implementation of pre-contractual
measures taken in response to the data subject’s request;
(d) the transfer is necessary for the conclusion or performance of a contract
concluded in the interest of the data subject between the responsible party and
a third party; or
10
(e) the transfer is for the benefit of the data subject, and—
(i) it is not reasonably practicable to obtain the consent of the data subject to
that transfer; and
(ii) if it were reasonably practicable to obtain such consent, the data subject
would be likely to give it.
15
(2) For the purpose of this section—
(a) ‘‘binding corporate rules’’ means personal information processing policies,
within a group of undertakings, which are adhered to by a responsible party or
operator within that group of undertakings when transferring personal
information to a responsible party or operator within that same group of 20
undertakings in a foreign country; and
(b) ‘‘group of undertakings’’ means a controlling undertaking and its controlled
undertakings.
CHAPTER 10
ENFORCEMENT
25
Interference with protection of personal information of data subject
73. For the purposes of this Chapter, interference with the protection of the personal
information of a data subject consists, in relation to that data subject, of—
(a) any breach of the conditions for the lawful processing of personal information
as referred to in Chapter 3;
30
(b) non-compliance with section 22, 54, 69, 70, 71 or 72; or
(c) a breach of the provisions of a code of conduct issued in terms of section 60.
Complaints
74. (1) Any person may submit a complaint to the Regulator in the prescribed manner
and form alleging interference with the protection of the personal information of a data 35
subject.
(2) A responsible party or data subject may, in terms of section 63(3), submit a
complaint to the Regulator in the prescribed manner and form if he, she or it is aggrieved
by the determination of an adjudicator.
Mode of complaints to Regulator
40
75. (1) A complaint to the Regulator must be made in writing.
(2) The Regulator must give such reasonable assistance as is necessary in the
circumstances to enable a person, who wishes to make a complaint to the Regulator, to
put the complaint in writing.
Action on receipt of complaint
76. (1) On receiving a complaint in terms of section 74, the Regulator may—
(a) conduct a pre-investigation as referred to in section 79;
45