Tax and Legal Insights | 2 min read

POPIA Explained – Part 12

Transfer of personal information to a foreign country

By Lize de la Harpe, legal adviser

In the last edition we discussed the requirements for the Retention of Records.

In this edition we will take a closer at the requirements for the Transfer of personal information to a foreign country in the context of POPIA.

Let’s recap

It’s important to remember that the principles governing the processing of personal information applies to the transfer of personal information to third parties in countries outside South Africa.

In part 6 (copy attached) we discussed Condition 6, being Openness. As explained, responsible parties must be transparent about their reasons for obtaining personal information and must ensure that what they do with the information is in line with the reasonable expectations of the data subject. 

As such, section 18 (notification to data subject) states that responsible parties must take reasonably practicable steps to ensure the data subject is aware of the fact that (inter alia) the fact that the responsible party intends to transfer the information to a foreign country (or international organization) and the level of protection afforded to the information by that foreign country or international organization.

Section 72 – transfer of personal information outside the Republic

Section 72 regulates the transfer of personal information to a foreign country.

Section 72(1)(a) states that a responsible person in the Republic may not transfer personal information about a data subject to a third party who is in a foreign country unless the third party (who is the recipient of the information) is subject to a law, binding corporate rules or a binding agreement which provides an adequate level of protection that effectively upholds the principles for reasonable processing of the information that are substantially similar to the Conditions for the lawful processing of personal information and includes provisions that are substantially similar to section 72 relating to the further transfer of personal information from the recipient to a third party who is in a foreign country.

What happens when the foreign country does not have an adequate level of protection?

All is not lost. If a foreign country (outside South Africa) does not have an adequate level of protection in respect of the personal information transferred (*i.e.: does not meet the requirements of section 72(1)(a) as discussed above), the transfer will still be possible if:

  1. the data subject has consented to the transfer (*after being informed of any potential risks); or
  • the transfer is necessary for the performance of a contract between the data subject and the responsible party, or for the implementation of pre-contractual measures taken in response to the data subject’s request; or
  • the transfer is necessary for the conclusion or performance of a contract concluded (in the data subject’s interest) between the responsible party and a third party; or
  • the transfer is for the benefit of the data subject, and:
  1. it is not reasonably practical to obtain the consent of the data subject to that transfer; and
  2. if it were reasonably practical to obtain such consent, the data subject would be likely to give it.

Conclusion

It is clear from the above that POPIA sets out very specific conditions as to when personal information may be transferred to a foreign country. Each business should therefore carefully consider the countries to which it typically transfers personal information, ascertain whether or not these countries in fact have laws (or binding corporate rules or a binding agreement) that provides an adequate level of protection of such personal information, and if NOT, whether any of the other exceptions as set in section 72(1) (as discussed above) will apply.

We have now discussed the transfer of personal information to a foreign country in detail – in the next edition we will take a closer look at the role of the Information Officer.

Glacier Financial Solutions (Pty) Ltd and Sanlam Life Insurance Ltd are licensed financial services providers

Your Next Read

Industry Insights | 3 min read
Glacier to acquire Alexander Forbes’ individual client administration business

Receive the latest Glacier Insights delivered to your inbox


Please enabled javascript to view Glacier.