Protection of Businesses Act, 1978
R 385
Protection of Personal Information Act, 2013 (Act No. 4 of 2013)Chapter 3 : Conditions for Lawful Processing of Personal InformationPart A : Processing of personal information in generalCondition 2 : Processing limitation11. Consent, justification and objection |
| (1) | Personal information may only be processed if— |
| (a) | the data subject or a competent person where the data subject is a child consents to the processing; |
| (b) | processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party; |
| (c) | processing complies with an obligation imposed by law on the responsible party; |
| (d) | processing protects a legitimate interest of the data subject; |
| (e) | processing is necessary for the proper performance of a public law duty by a public body; or |
| (f) | processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied. |
(2)
| (a) | The responsible party bears the burden of proof for the data subject’s or competent person’s consent as referred to in subsection (1)(a). |
| (b) | The data subject or competent person may withdraw his, her or its consent, as referred to in subsection (1)(a), at any time: Provided that the lawfulness of the processing of personal information before such withdrawal or the processing of personal information in terms of subsection (1)(b) to (f) will not be affected. |
| (3) | A data subject may object, at any time, to the processing of personal information— |
| (a) | in terms of subsection (1)(d) to (f), in the prescribed manner, on reasonable grounds relating to his, her or its particular situation, unless legislation provides for such processing; or |
| (b) | for purposes of direct marketing other than direct marketing by means of unsolicited electronic communications as referred to in section 69. |
| (4) | If a data subject has objected to the processing of personal information in terms of subsection (3), the responsible party may no longer process the personal information. |
