Protection of Personal Information Act, 2013 (Act No. 4 of 2013)Chapter 3 : Conditions for Lawful Processing of Personal InformationPart A : Processing of personal information in generalCondition 4 : Further processing limitation15. Further processing to be compatible with purpose of collection |
| (1) | Further processing of personal information must be in accordance or compatible with the purpose for which it was collected in terms of section 13. |
| (2) | To assess whether further processing is compatible with the purpose of collection, the responsible party must take account of— |
| (a) | the relationship between the purpose of the intended further processing and the purpose for which the information has been collected; |
| (b) | the nature of the information concerned; |
| (c) | the consequences of the intended further processing for the data subject; |
| (d) | the manner in which the information has been collected; and |
| (e) | any contractual rights and obligations between the parties. |
| (3) | The further processing of personal information is not incompatible with the purpose of collection if— |
| (a) | the data subject or a competent person where the data subject is a child has consented to the further processing of the information; |
| (b) | the information is available in or derived from a public record or has deliberately been made public by the data subject; |
| (c) | further processing is necessary— |
| (i) | to avoid prejudice to the maintenance of the law by any public body including the prevention, detection, investigation, prosecution and punishment of offences; |
| (ii) | to comply with an obligation imposed by law or to enforce legislation concerning the collection of revenue as defined in section 1 of the South African Revenue Service Act, 1997 (Act No. 34 of 1997); |
| (iii) | for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated; or |
| (iv) | in the interests of national security; |
| (d) | the further processing of the information is necessary to prevent or mitigate a serious and imminent threat to— |
| (i) | public health or public safety; or |
| (ii) | the life or health of the data subject or another individual; |
| (e) | the information is used for historical, statistical or research purposes and the responsible party ensures that the further processing is carried out solely for such purposes and will not be published in an identifiable form; or |
| (f) | the further processing of the information is in accordance with an exemption granted under section 37. |