Protection of Personal Information Act, 2013 (Act No. 4 of 2013)Chapter 3 : Conditions for Lawful Processing of Personal InformationPart A : Processing of personal information in generalCondition 2 : Processing limitation12. Collection directly from data subject |
| (1) | Personal information must be collected directly from the data subject, except as otherwise provided for in subsection (2). |
| (2) | It is not necessary to comply with subsection (1) if— |
| (a) | the information is contained in or derived from a public record or has deliberately been made public by the data subject; |
| (b) | the data subject or a competent person where the data subject is a child has consented to the collection of the information from another source; |
| (c) | collection of the information from another source would not prejudice a legitimate interest of the data subject; |
| (d) | collection of the information from another source is necessary— |
| (i) | to avoid prejudice to the maintenance of the law by any public body, including the prevention, detection, investigation, prosecution and punishment of offences; |
| (ii) | to comply with an obligation imposed by law or to enforce legislation concerning the collection of revenue as defined in section 1 of the South African Revenue Service Act, 1997 (Act No. 34 of 1997); |
| (iii) | for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated; |
| (iv) | in the interests of national security; or |
| (v) | to maintain the legitimate interests of the responsible party or of a third party to whom the information is supplied; |
| (e) | compliance would prejudice a lawful purpose of the collection; or |
| (f) | compliance is not reasonably practicable in the circumstances of the particular case. |