POPIA — POPIA Guidance Note: Guidance Note on Lawful Processing of Personal Information (source: https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-GuidanceNote-PPI-LawfulProcessing-202106.pdf)
GUIDANCE NOTE ON EXEMPTIONS FROM THE CONDITIONS
FOR LAWFUL PROCESSING OF PERSONAL INFORMATION
IN TERMS OF SECTION 37 AND 38 OF THE PROTECTION OF
PERSONAL INFORMATION ACT 4 OF 2013
JUNE 2021
Information Regulator’s Guidance Note on Exemptions
Table of Contents
1. DEFINITIONS ..................................................................................................................................... 3
2. INTRODUCTION ................................................................................................................................ 4
3. PURPOSE ........................................................................................................................................... 5
4. EXEMPTIONS FROM THE CONDITIONS FOR LAWFUL PROCESSING OF PERSONAL
INFORMATION ................................................................................................................................... 6
5. PUBLICATION OF AN EXEMPTION NOTICE ............................................................................ 14
6. CONTACT DETAILS ........................................................................................................................ 14
EXEMPTION APPLICATION FORM ..................................................................................................... 15
Information Regulator’s Guidance Note on Exemptions
1. DEFINITIONS
Below are the definitions relevant to this Guidance Note. For a complete list of definitions,
please refer to the Protection of Personal Information Act 4 of 2013 (POPIA)
1.1 ‘‘Data subject’’ means the person to whom personal information relates;
1.2 ‘‘De-Identify’’, in relation to personal information of a data subject, means to delete
any information that-
(a) identifies the data subject;
(b) can be used or manipulated by a reasonably foreseeable method to identify
the data subject; or
(c) can be linked by a reasonably foreseeable method to other information that
identifies the data subject,
1.3 ‘‘Processing’’ means any operation or activity or any set of operations, whether or
not by automatic means, concerning personal information, including-
(a) the collection, receipt, recording, organisation, collation, storage, updating or
modification, retrieval, alteration, consultation or use;
(b) dissemination by means of transmission, distribution or making available in
any other form; or
(c) merging, linking, as well as restriction, degradation, erasure or destruction of
information;
1.4 “Public body” means-
(d) any department of state or administration in the national or provincial sphere of
government or any municipality in the local sphere of government; or
Information Regulator’s Guidance Note on Exemptions
(e) any other functionary or institution when-
(i) exercising a power or performing a duty in terms of the Constitution or a
provincial constitution; or
(j) exercising a public power or performing a public function in terms of any
legislation;
1.5 “Relevant function” for purposes of section 38(1) of POPIA, means any function-
(a) of a public body; or
(b) conferred on any person in terms of the law, which is performed with the view
to protecting members of the public against-
i) financial loss due to dishonesty, malpractice or other seriously improper
conduct by, or the unfitness or incompetence of, persons concerned in
the provision of banking, insurance, investment or other financial
services or in the management of bodies corporate; or
ii) dishonesty, malpractice or other seriously improper conduct by, or the
unfitness or incompetence of, persons authorised to carry on any
profession or other activity.
1.6 “Responsible party” means a public or private body or any other person which,
alone or in conjunction with others, determines the purpose of and means for
processing personal information;
2. INTRODUCTION
2.1 POPIA prescribes the eight (8) conditions for the lawful processing of personal
information by or for a responsible party. These conditions are not applicable to the
processing of personal information to the extent that such processing is exempted in
Information Regulator’s Guidance Note on Exemptions
terms of section 37 or 38, from one or more of the conditions concerned in relation
to such processing.
2.2 Processing of personal information is not in breach of a condition for the processing
of such information if the-
2.2.1 Regulator grants an exemption in terms of section 37; or
2.2.2 processing is in accordance with section 38.
2.3 In terms of section 37(1) of POPIA the Regulator may by notice in the Gazette grant
an exemption to a responsible party to process certain personal information, even if
that processing is in breach of a condition for the lawful processing of such
information, or any measure that gives effect to such condition, if the Regulator is
satisfied that the requirements that are stated therein are met.
2.4 In terms of section 38(1) of POPIA, personal information processed for the purpose
of discharging a relevant function is exempt from sections 11(3) and (4), 12, 15 and
18 of POPIA in any case to the extent to which the application of those provisions to
the personal information would be likely to prejudice the proper discharge of that
function.
3. PURPOSE
3.1 The purpose of this Guidance Note is to provide guidance to the responsible parties
who-
3.1.1 intend to apply for exemption in terms of section 37 of POPIA; or
3.1.2 are exempt from the processing of personal information in respect of certain
functions in terms of section 38 of POPIA.
Information Regulator’s Guidance Note on Exemptions
3.2 This document provides guidance only and the responsible parties are therefore
required to ensure compliance with the relevant provisions of POPIA.
4. EXEMPTIONS FROM THE CONDITIONS FOR LAWFUL PROCESSING OF PERSONAL
INFORMATION
4.1 General
4.1.1 Processing of personal information is not in breach of a condition for the
processing of such information if the Regulator grants an exemption in
terms of section 37 of POPIA or where processing is in accordance with
section 38 of POPIA.
4.1.2 The exemptions are strictly applicable in instances provided for in sections
37 and 38 of POPIA. They should not be routinely relied on and should be
considered on a case-by-case basis.
4.1.3 If an exemption is not applicable to the processing of personal information,
the applicable conditions for lawful processing of personal information must
be complied with.
4.1.4 The Regulator may impose reasonable conditions in respect of any
exemption granted in terms of section 37 of POPIA.
4.2 Exemptions on applications
4.2.1 The Regulator may, in terms of section 37(1) and on application by a
responsible party (using the attached exemption application form), grant an
exemption from complying with a specific condition when processing
personal information, even if such processing is in breach of any of the
condition for the lawful processing of such information, or any measure that
gives effect to such condition.
Information Regulator’s Guidance Note on Exemptions
4.2.2 The responsible party applying for an exemption must satisfy the Regulator
that either of the following requirements are met-
4.2.2.1 processing is in the public interest; or
4.2.2.2 processing involves a clear benefit to the data subject.
4.2.3 Public Interest
4.2.3.1 The responsible party must satisfy the Regulator that:-
4.2.3.1.1 the processing of personal information in question is in
the public interest; and
4.2.3.1.2 the public interest is so significant that it outweighs the
data subject’s right to the protection of its or his or her
personal information.
4.2.3.2 POPIA does not define public interest but furnishes examples of
what constitutes public interest, as stipulated in paragraph 4.2.3.4
below.
4.2.3.3 Public interest is a wide and diverse concept that cannot and
should not be limited in its scope and application. The definition of
what constitutes public interest varies across jurisdictions and
should be assessed on a case-by-case basis. In its very basic
formulation, public interest is the notion that an action or process
or outcome widely and generally benefits the public at large (as
opposed to a few or a single entity or person) and should be
accepted, imposed or pursued in the spirit of equality and justice.
4.2.3.4 In terms of section 37(2) of POPIA, public interest includes the
following:
Information Regulator’s Guidance Note on Exemptions
4.2.3.4.1 the interests of national security;
a) “National Security” is not specifically defined in
any law in South Africa. However, section 198 of
the Constitution of the Republic of South Africa
prescribed principles which govern national
security in the Republic.
b) A responsible party who applies for an exemption
from complying with a condition for lawful
processing of personal information on the ground
of national security should be guided by the
following constitutional principles-
i) National security must reflect the resolve of
South Africans, as individuals and as a
nation, to live as equals, to live in peace and
harmony, to be free from fear and want and
to seek a better life.
ii) The resolve to live in peace and harmony
precludes any South African citizen from
participating in armed conflict, nationally or
internationally, except as provided for in
terms of the Constitution or national
legislation.
iii) National security must be pursued in
compliance with the law, including
international law.
iv) National security is subject to the authority of
Parliament and the national executive.
Information Regulator’s Guidance Note on Exemptions
c) The responsible party will not be exempted if the
impact of compliance would be trivial or is not
linked to national security (e.g. to avoid
embarrassment). The responsible party must be
able to show-
i) how compliance with the privacy rights of
data subjects jeopardises national security;
ii) that processing the personal information of
the data subject is in the public interest as it
safeguards the national security;
iii) that such public interest in the national
security outweighs to a substantial degree
the privacy rights of the data subject.
4.2.3.4.2 the prevention, detection and prosecution of offences;
4.2.3.4.3 important economic and financial interests of a public
body;
a) A public body which intends investigating fraud
and corruption that impacts its economic and
financial interests may apply for exemption from
any condition for lawful processing of processing
of personal information.
4.2.3.4.4 fostering compliance with legal provisions established
in the interests referred to under paragraphs 4.2.3.4.2
and 4.2.3.4.3 above;
4.2.3.4.5 historical, statistical or research activity; or
Information Regulator’s Guidance Note on Exemptions
4.2.3.4.6 the special importance of the interest in freedom of
expression:
4.2.4 Clear Benefit to the data subject
4.2.4.1 The responsible party should prove that:
4.2.4.1.1 the processing involves a clear benefit to the data
subject or a third party; and
4.2.4.1.2 the clear benefit, referred to in paragraph 4.2.4.1.1
above, outweighs, to a substantial degree, any
interference with the privacy of the data subject or third
party that could result from such processing.
4.2.4.2 The responsible party must, in its application for an exemption-
4.2.4.2.1 provide adequate reasons why processing of personal
information, in breach of any of the conditions for lawful
processing of personal information, will be to the
benefit of the data subject;
4.2.4.2.2 state the nature of the benefits to a data subject or a
third party;
4.2.4.2.3 specify how the benefit to a data subject or a third
party outweighs, to a substantial degree, any
interference with the privacy of such data subject or
third party.
4.2.5 An exemption in terms of section 37 of POPIA may not be a full exemption
from all the conditions for the lawful processing of personal information but
may only be granted for one or some of the conditions for the lawful
processing of personal information.
Information Regulator’s Guidance Note on Exemptions
4.2.6 In the event that the Regulator is satisfied that the application for exemption
meets the requirements listed in paragraph 4.2.3 or 4.2.4 above, it may
impose reasonable conditions in respect of any exemption granted and
these conditions will be decided on a case-by-case basis. The conditions
may include, for example, the requirement for a responsible party to
implement certain appropriate, reasonable technical and organisational
measures to secure the integrity and confidentiality of personal information.
4.2.7 Before submitting the exemption application, a responsible party must
consider whether its processing falls under-
4.2.7.1 Exemptions provided for in section 37 of POPIA; or
4.2.7.2 Exemptions provided for in section 38 of POPIA, as detailed in
paragraph 4.3 below.
4.2.8 A completed Exemption Application Form, attached hereto, may be
submitted to the Regulator through the following channels-
4.2.8.1 Email:
[email protected]
4.2.8.2 Postal: P.O Box 31533
Braamfontein
Johannesburg
2017
4.2.8.3 Hand delivery: JD House
27 Stiemens Street
Braamfontein
Johannesburg
2001
4.2.9 Due to the current pandemic (Covid-19), the Regulator recommends that
applications for exemptions in terms of section 37 of POPIA be submitted
Information Regulator’s Guidance Note on Exemptions
by email to limit the transmission of the virus. However, the Regulator will
accept applications in accordance with paragraph 4.2.8.2 or 4.2.8.3 above.
4.2.10 Once the exemption application is received and recorded in the system of
the Regulator, the responsible party will receive an acknowledgement email
or letter with a reference number for the application. When submitting
additional information to the application, the responsible party must include
the allocated reference number to enable the Regulator to link the
additional information to the existing application.
4.3 Exemption in respect of certain functions
4.3.1 Section 38(1) of POPIA provides for an exemption from complying with
sections 11(3) and (4), 12, 15 and 18 if the responsible party processes
personal information for the purpose of discharging a relevant function.
4.3.2 A relevant function for the purpose of section 38(1) of POPIA means any
function-
4.3.2.1 of a public body; or
4.3.2.2 conferred on any person in terms of the law.
4.3.3 The relevant function referred to in paragraph 4.3.2 above must be
performed with the view to protect members of the public against-
4.3.3.1 financial loss due to dishonesty, malpractice or other seriously
improper conduct by, or the unfitness or incompetence of, persons
concerned in the provision of banking, insurance, investment or
other financial services or in the management of bodies corporate;
or
Information Regulator’s Guidance Note on Exemptions
4.3.3.2 dishonesty, malpractice or other seriously improper conduct by, or
the unfitness or incompetence of, persons authorised to carry on
any profession or other activity.
4.3.4 The relevant function must comply with all the conditions for the lawful
processing of personal information. However such function may be
exempted from compliance with sections 11(3) and (4), 12, 15, and 18 of
POPIA, in any case to the extent to which the application of these
provisions to the personal information would be likely to prejudice the
discharge of that function.
4.3.5 The exempted functions referred to in paragraph 4.3.4 above, only relate to
the following conditions-
4.3.5.1 The data subject’s right to object to the processing of personal
information, in terms of section 11(3) and (4);
4.3.5.2 The obligation to ensure that personal information is collected
directly from the data subject, in terms of section 12;
4.3.5.3 The requirement that further processing must be compatible with
purpose of collection, in terms of section 15; and
4.3.5.4 The requirement to notify data subject when collecting personal
information, in terms of section 18.
4.3.6 The responsible party relying on any of the conditions referred to in
paragraph 4.3.5 above, must document its reasons for relying on an
exemption under section 38. Those reasons will be crucial when the
Regulator investigates any complaint in terms section 74 of POPIA or
conducts an assessment in terms of section 89 of POPIA.
Information Regulator’s Guidance Note on Exemptions
5. PUBLICATION OF AN EXEMPTION NOTICE
The Regulator will, upon granting an exemption, publish a notice in the Gazette in terms of
section 37(1) of POPIA. The exemption granted by the Regulator only comes into
operation on the date of publication in the Gazette.
6. CONTACT DETAILS
6.1. If after reading this Guide, the responsible party still requires help in completing the
exemption application form, they may contact our Customer Service Centre on-
Email:
[email protected]
6.2. Please note that the Regulator’s operating hours are from 08h30 am to 17h00
Monday to Friday only.
Issued by
INFORMATION REGULATOR
Date: 18 JUNE 2021
Information Regulator’s Guidance Note on Exemptions
EXEMPTION APPLICATION FORM
NOTE: The personal information submitted herein shall be solely used for purposes of an exemption
application submitted to the Information Regulator (“Regulator”) in terms of section 37(1) of the
Protection of Personal Information Act 04 of 2013 (POPIA).
All the information submitted herein shall be used for the purpose stated above, as mandated by
POPIA. This Information may be disclosed to the public. The Regulator undertakes to secure the
integrity and confidentiality of personal information in its possession or under its control by taking
appropriate, reasonable technical and organisational measures to prevent loss of, damage to or
unauthorised destruction of personal information and unlawful access to or processing of
personal information.
PART A
RESPONSIBLE PARTY
Type of Body Public Body Private Body
Full Name of the Body
(Registered Name)
Trading Name
Registration No, if any
Full Name of
Information Officer
Information Officer’s
Registration Number
Postal Address
(Official)
Information Regulator’s Guidance Note on Exemptions
Physical Address
(Official)
Official Landline
Number
Official Cell Number
Official Fax Number
Official Email Address
Website, if any
PART B
CONDITIONS FOR THE LAWFUL PROCESSING OF PERSONAL INFORMATION
Please select the condition(s) for lawful processing of personal information from which you apply to be
exempted
Accountability-as referred to in section 8
Processing limitation- as referred to in sections 9 to 12
Purpose specification- as referred to in sections 13 and 14
Further processing limitation- as referred to in section 15
Information quality- as referred to in section 16
Openness- as referred to in sections 17 and 18
Security safeguard- as referred to in sections 19 to 22
Data subject participation- as referred to in sections 23 to 25.
PART C
PROVIDE REASONS WHY IT IS NECESSARY FOR THE RESPONSIBLE PARTY TO
PROCESS PERSONAL INFORMATION IN BREACH OF THE CONDITIONS FOR LAWFUL
PROCESSING OF PERSONAL INFORMATION
The public interest in the processing of personal information outweighs, to a substantial
degree, any interference with the privacy of the data subject that could result from such
processing.
Information Regulator’s Guidance Note on Exemptions
Select the applicable public a) The interests of national security
interest
b) The prevention, detection and prosecution of
offences
c) Important economic and financial interests of a
public body
d) Fostering compliance with legal provisions
established in the interests referred to under
paragraphs (b) and (c) above
e) Historical, statistical or research activity
f) The special importance of the interest in freedom of
expression
Specify any other public
interest not specifically
provided herein
Please provide reasons how
selected or specified public
interest in the processing of
personal information
outweighs, to a substantial
degree, any interference with
the privacy of the data subject
that could result from such
processing.
The processing involves a clear benefit to the data subject or a third party that
outweighs, to a substantial degree, any interference with the privacy of the data subject
or third party that could result from such processing.
Please specify the nature of the
clear benefits to a data subject
or a third party.
Please explain how the above-
mentioned benefits to a data
subject or a third outweigh, to a
substantial degree, any
interference with the privacy of
such data subject or third
party.
Information Regulator’s Guidance Note on Exemptions
PART D
DECLARATION
I declare that the information contained herein is true, correct and accurate.
SIGNED and DATED at ________________on this the________day of _______________20__
_______________________
INFORMATION OFFICER
Information Regulator’s Guidance Note on Exemptions
PART E
The following information is required for statistical purposes. Please choose a sector(s) that apply to your body.
GOVERNMENT
PUBLIC ENTITIES PRIVATE BODY PROFESSION
Item Classification of X Item Classification of a Public X Item Name of Industry or Sector X Item Type of profession X
Government Entity
1. National Government 1. Constitutional Entities 1 Education 1 Legal
2. Provincial Government 2. Schedule 2 Public Entity 2 Insurance 2 Built Environment
3. Local Government 3. Schedule 3A Public Entity 3 Health Facilities 3 Financial
4. Schedule 3B Public Entity 4 Telecommunications 4 Medical and Allied Health Services
LEGISLATURE
5. Schedule 3C Public Entity 5 Pharmaceutical
Parliament 6 Media And Social Media
OTHERS, specify OTHERS, Specify
Gauteng Provincial Legislature 7 Retail/Direct Marketing
Western Cape Provincial 8 Tourism 5.
Legislature
Northern Cape Provincial 9 Transportation, Storage and
Legislature Logistics
Limpopo Provincial Legislature 10 Manufacturing/Production
Northwest Provincial 11 Banks
Legislature
Information Regulator’s Guidance Note on Exemptions
GOVERNMENT
PUBLIC ENTITIES PRIVATE BODY PROFESSION
Free State Provincial 12 International Organizations
Legislature
Mpumalanga Provincial 13 Real Estate
Legislature
14 Credit Bureaus
Eastern Cape Provincial
Legislature OTHERS, specify
Kwazulu-Natal Provincial
Legislature
Trespass Act, 1959
