In today’s data-driven world, compliance with privacy laws like the Protection of Personal Information Act 4 of 2013 (“POPIA”) is non-negotiable for businesses, especially entrepreneurs looking to scale.  

Section 11 of POPIA sets out the key principles for the lawful processing of personal information, making it essential reading for any entrepreneur handling customer data (but not limited thereto of course). Personal information can only be processed under specific conditions. Understanding these ensures you protect your business and the rights of individuals. 

When is Processing Allowed? 

Under Section 11, you may process personal information if: 

• Consent: The data subject (or their guardian, if a child) consents. 
• Contracts: Processing is necessary to execute or conclude a contract involving the data subject. 
• Legal Obligation: Compliance with laws necessitates the processing. 
• Legitimate Interests: The data subject or a third party’s interests are protected. 
• Public Duty: A public body requires the information for a public duty. 
• Responsible Party’s Interests: Processing aligns with the legitimate business interests of your company or a relevant third party. 

What Constitutes Consent? 

POPIA defines consent as a voluntary, specific, and informed expression of will. To ensure compliance: 

• Provide clear, detailed information about why and how data will be used. 
• Allow data subjects to give or withhold consent freely, without coercion. 
• Obtain explicit consent—this could be ticking a box or signing a form. 

The burden of proof for consent lies with you as the responsible party. Moreover, individuals can withdraw their consent at any time, although processing conducted before the withdrawal remains lawful.

Withdrawal and Objection of Consent 

Section 11(2) and 11(3) highlight the rights of individuals to object to processing, especially if: 

• The information is being used for direct marketing. 
• They believe the processing undermines their privacy. 

Such objections must be made on reasonable grounds and in a prescribed format. 

While obtaining consent is vital, POPIA allows some exceptions where processing can proceed without it. For example: 

• Legal Requirements: If the law obliges data handling (e.g., tax compliance). 
• Contracts: To fulfil contractual obligations. 
• Legitimate Interests: If processing safeguards significant business interests. 

Exemptions from Consent Requirements 

Under Sections 36–38, you might not need consent if: 

• The Information Regulator grants an exemption. 
• Processing serves public interest functions, such as preventing financial fraud or malpractice. 

Actionable Tips for Entrepreneurs 

• Audit Data Practices: Regularly review how you collect, use, and store personal information. 
• Craft Transparent Policies: Clearly state your data-handling policies on your website or customer communications. 
• Educate Your Team: Make sure employees handling customer data understand POPIA requirements. 

Entrepreneurs often juggle growth objectives with regulatory obligations. By understanding how POPIA impact you, you not only align with legal requirements but also build trust with your customers—essential for long-term success.

Written by Nicolene Schoeman-Louw; Specialist: Commercial Law, Technology Law and Contract Drafting; SchoemanLaw Inc