Topic 2: Section 72 of POPIA Copy

This section is not yet in force, but will be required for cross-border transfer of personal information to be permissible and that one of the following must be present:

Adequate legal protection: The recipient of the personal information must be subject to a law, binding corporate rules or binding agreement which proved an adequate level of protection that effectively upholds the principles and lawful processing of personal information.
Consent: The data subject consents to the transfer.
Necessary for the performance of a contract: Between the data subject and the responsible party or for the implementation of pre-contractual measures as per the data subjects request.
Interests of the data subject: The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the responsible party and a third party.
Benefits of the data subject: The transfer is for the benefit of the data subject in circumstance where it is not reasonable practicable to obtain the consent of the data subject for the transfer, and the data subject would be likely to give consent had it been obtained.

The experience in other jurisdictions has show that one of the easiest and most convenient ways to effect cross-border data transfers is where the transfer takes place to a country with a law which provides “an adequate level of protection”

The UK ICO identifies six criteria’s to take into consideration when transferring:

The nature of the personal data;
The purpose for which the data is intended to be processed;
The period during which the data is intended to be processed;
The country or territorial of origin of the information contained in the data;
The country or territory of origin of the information contained in the data;
The country or territory of final destination of the information and
Any security measures taken in respect of the data in the country of territory of destination.