Protection of Personal Information Act, cross-border transfer

POPIA, s. 72 (transfer of personal information outside the Republic)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 July 2020.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before transferring personal information outside South Africa, confirm the recipient country, its binding rules, or an agreement provides an adequate level of protection substantially similar to the Act's conditions, or that another listed transfer ground, such as the data subject's consent, applies.
Obtain the Information Regulator's prior authorisation before transferring special personal information, or a child's personal information, to a country that does not provide an adequate level of protection.

What it reaches

Obligation class

Transfer, Licensing

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 72(1) bars a responsible party in the Republic from transferring personal information about a data subject to a third party in a foreign country unless the recipient is subject to a law, binding corporate rules, or a binding agreement that effectively upholds substantially similar processing conditions and substantially similar onward-transfer restrictions, or unless the data subject consents, the transfer is necessary to perform a contract with or for the benefit of the data subject, or the transfer benefits the data subject and consent is not reasonably practicable to obtain but would likely be given.

Section 57(1)(d) separately requires a responsible party to obtain the Information Regulator's prior authorisation before transferring special personal information, or a child's personal information, to a country that does not provide an adequate level of protection.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics

Read the law

Protection of Personal Information Act 4 of 2013, Government Gazette text hosted by the Information Regulator of South Africa

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app