Government Gazette Staatskoerant - Justice Home

1 , Government GazetteStaatskoerantREPUBLIC OF SOUTH AFRICAREPUBLIEK VAN SUID-AFRIKATHE PRESIDENCYDIE PRESIDENSIENo. 912No. 91226 November 201326 November 2013It is hereby notified that the Presidenthas assented to the following Act, whichis hereby published for generalinformation: Hierby word bekend gemaak dat diePresident sy goedkeuring gehg het aandie onderstaande Wet wat hierby teralgemene inligting gepubliseer word: Act No. 4 of 2013: protection ofPersonal Information Act, 2013 Wet No 4 van 2013: Wet opBeskerming van PersoonlikeInligting, 20139 771682 58400312163 Vol. 58126 November 2013No. 37067 Cape Town,Kaapstad,Reproduced by Sabinet Online in terms of Government Printer s Copyright Authority No. 10505 dated 02 February 1998 2No.

2 37067 Government Gazette , 26 November 2013 Act No. 4 of 2013 protection of Personal Information Act, 2013 GENERAL EXPLANATORY NOTE:[]Words in bold type in square brackets indicate omissions fromexisting underlined with a solid line indicate insertions inexisting promote the protection of personal information processed by public and privatebodies; to introduce certain conditions so as to establish minimum requirementsfor the processing of personal information; to provide for the establishment of anInformation Regulator to exercise certain powers and to perform certain dutiesand functions in terms of this Act and the Promotion of Access to Information Act,2000; to provide for the issuing of codes of conduct; to provide for the rights ofpersons regarding unsolicited electronic communications and automated decisionmaking; to regulate the flow of personal information across the borders of theRepublic; and to provide for matters connected THAT section 14 of the Constitution of the Republic of South Africa, 1996, provides thateveryone has the right to privacy; the right to privacy includes a right to protection against the unlawful collection,retention, dissemination and use of personal information; the State must respect, protect, promote and fulfil the rights in the Bill of Rights.

3 AND BEARING IN MIND THAT consonant with the constitutional values of democracy and openness, the need foreconomic and social progress, within the framework of the information society,requires the removal of unnecessary impediments to the free flow of information,including personal information;AND IN ORDER TO regulate, in harmony with international standards, the processing of personalinformation by public and private bodies in a manner that gives effect to the rightto privacy subject to justifiable limitations that are aimed at protecting other rightsand important interests,(English text signed by the President)(Assented to 19 November 2013)Reproduced by Sabinet Online in terms of Government Printer s Copyright Authority No. 10505 dated 02 February 1998 4No. 37067 Government Gazette , 26 November 2013 Act No.

4 4 of 2013 protection of Personal Information Act, 2013 PARLIAMENT of the Republic of South Africa therefore enacts, as follows: CONTENTS OF ACTCHAPTER 1 DEFINITIONS AND PURPOSE1. Definitions2. Purpose of ActCHAPTER 2 APPLICATION PROVISIONS3. Application and interpretation of Act4. Lawful processing of personal information5. Rights of data subjects6. Exclusions7. Exclusion for journalistic, literary or artistic purposesCHAPTER 3 CONDITIONS FOR LAWFUL PROCESSING OF PERSONAL INFORMATIONPart AProcessing of personal information in generalCondition 1 Accountability8. Responsible party to ensure conditions for lawful processingCondition 2 Processing limitation9. Lawfulness of processing10. Minimality11. Consent, justification and objection12. Collection directly from data subjectCondition 3 Purpose specification13.

5 Collection for specific purpose14. Retention and restriction of recordsCondition 4 Further processing limitation15. Further processing to be compatible with purpose of collectionCondition 5 Information quality16. Quality of information45101520253035 Reproduced by Sabinet Online in terms of Government Printer s Copyright Authority No. 10505 dated 02 February 1998 6No. 37067 Government Gazette , 26 November 2013 Act No. 4 of 2013 protection of Personal Information Act, 2013 Condition 6 Openness17. Documentation18. Notification to data subject when collecting personal informationCondition 7 Security safeguards19. Security measures on integrity and confidentiality of personal information20. Information processed by operator or person acting under authority21.

6 Security measures regarding information processed by operator22. Notification of security compromisesCondition 8 data subject participation23. Access to personal information24. Correction of personal information25. Manner of accessPart BProcessing of special personal information26. Prohibition on processing of special personal information27. General authorisation concerning special personal information28. Authorisation concerning data subject s religious or philosophical beliefs29. Authorisation concerning data subject s race or ethnic origin30. Authorisation concerning data subject s trade union membership31. Authorisation concerning data subject s political persuasion32. Authorisation concerning data subject s health or sex life33. Authorisation concerning data subject s criminal behaviour or biometricinformationPart CProcessing of personal information of children34.

7 Prohibition on processing personal information of children35. General authorisation concerning personal information of childrenCHAPTER 4 EXEMPTION FROM CONDITIONS FOR PROCESSING OFPERSONAL INFORMATION36. General37. Regulator may exempt processing of personal information38. Exemption in respect of certain functionsCHAPTER 5 SUPERVISIONPart AInformation Regulator39. Establishment of Information Regulator40. Powers, duties and functions of Regulator6510152025303540 Reproduced by Sabinet Online in terms of Government Printer s Copyright Authority No. 10505 dated 02 February 1998 8No. 37067 Government Gazette , 26 November 2013 Act No. 4 of 2013 protection of Personal Information Act, 201341. Appointment, term of office and removal of members of Regulator42. Vacancies43.

8 Powers, duties and functions of Chairperson and other members44. Regulator to have regard to certain matters45. Conflict of interest46. Remuneration, allowances, benefits and privileges of members47. Staff48. Powers, duties and functions of chief executive officer49. Committees of Regulator50. Establishment of Enforcement Committee51. Meetings of Regulator52. Funds53. protection of Regulator54. Duty of confidentialityPart BInformation Officer55. Duties and responsibilities of Information Officer56. Designation and delegation of deputy information officersCHAPTER 6 PRIOR AUTHORISATIONP rior Authorisation57. Processing subject to prior authorisation58. Responsible party to notify Regulator if processing is subject to priorauthorisation59. Failure to notify processing subject to prior authorisationCHAPTER 7 CODES OF CONDUCT60.

9 Issuing of codes of conduct61. Process for issuing codes of conduct62. Notification, availability and commencement of code of conduct63. Procedure for dealing with complaints64. Amendment and revocation of codes of conduct65. Guidelines about codes of conduct66. Register of approved codes of conduct67. Review of operation of approved code of conduct68. Effect of failure to comply with code of conductCHAPTER 8 RIGHTS OF data SUBJECTS REGARDING DIRECT MARKETINGBY MEANS OF UNSOLICITED ELECTRONIC COMMUNICATIONS,DIRECTORIES AND AUTOMATED DECISION MAKING69. Direct marketing by means of unsolicited electronic communications70. Directories71. Automated decision making8510152025303540 Reproduced by Sabinet Online in terms of Government Printer s Copyright Authority No.

10 10505 dated 02 February 1998 10No. 37067 Government Gazette , 26 November 2013 Act No. 4 of 2013 protection of Personal Information Act, 2013 CHAPTER 9 TRANSBORDER INFORMATION FLOWS72. Transfers of personal information outside RepublicCHAPTER 10 ENFORCEMENT73. Interference with protection of personal information of data subject74. Complaints75. Mode of complaints to Regulator76. Action on receipt of complaint77. Regulator may decide to take no action on complaint78. Referral of complaint to regulatory body79. Pre-investigation proceedings of Regulator80. Settlement of complaints81. Investigation proceedings of Regulator82. Issue of warrants83. Requirements for issuing of warrant84. Execution of warrants85. Matters exempt from search and seizure86.