Protection of Personal Information Act, special personal information and children

POPIA, ss. 26-35 (special personal information and children)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 July 2020.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process special personal information, including a person's biometric information, health, race, or political persuasion, unless a listed ground under sections 27 to 33 applies.
Do not process a child's personal information unless a competent person has given prior consent, another listed ground in section 35(1) applies, or the Information Regulator has authorised the processing as being in the public interest with appropriate safeguards.
Where you rely on a special-category authorisation for a data subject's religious belief, trade union membership, or political persuasion, do not supply that information to a third party without the data subject's consent.
Only process a data subject's biometric information or record of criminal behaviour where you are a body charged with applying criminal law or you obtained the information lawfully, and put appropriate safeguards in place before relying on any special personal information exception.

What it reaches

Obligation class

Prohibition, Consent, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 26 prohibits processing personal information about a data subject's religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information (a term the Act's definitions extend to fingerprinting, DNA analysis, retinal scanning and voice recognition), or their alleged criminal behaviour or related proceedings, unless section 27 applies.

Section 27 lifts the prohibition where the data subject consents, the processing is necessary to establish or defend a legal right, historical or research purposes apply, the information was deliberately made public by the data subject, or sections 28 to 33 authorise it for a specific category; sections 28 to 32 set narrower authorisations for religious bodies, race-based redress measures, trade unions, political organisations, and health or insurance processing, each barring disclosure to a third party without the data subject's consent, and section 33 authorises processing criminal-behaviour or biometric information by bodies charged with applying criminal law or by a responsible party that obtained it lawfully.

Section 34 separately prohibits processing a child's personal information unless section 35 applies, and section 35(1) permits it only with a competent person's prior consent, to establish or defend a legal right, to comply with international law, for historical or research purposes, or where the child made the information public with a competent person's consent; the Regulator may also authorise processing of a child's information in the public interest under section 35(2), subject to conditions safeguarding the child under section 35(3).

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice
serves_minors
handles_health_records

Read the law

Protection of Personal Information Act 4 of 2013, Government Gazette text hosted by the Information Regulator of South Africa

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app