Protection of Personal Information Act, 2013 (Act No. 4 of 2013)Chapter 9 : Transborder Information Flows72. Transfers of personal information outside Republic |
| (1) | A responsible party in the Republic may not transfer personal information about a data subject to a third party who is in a foreign country unless— |
| (a) | the third party who is the recipient of the information is subject to a law, binding corporate rules or binding agreement which provide an adequate level of protection that— |
| (i) | effectively upholds principles for reasonable processing of the information that are substantially similar to the conditions for the lawful processing of personal information relating to a data subject who is a natural person and, where applicable, a juristic person; and |
| (ii) | includes provisions, that are substantially similar to this section, relating to the further transfer of personal information from the recipient to third parties who are in a foreign country; |
| (b) | the data subject consents to the transfer; |
| (c) | the transfer is necessary for the performance of a contract between the data subject and the responsible party, or for the implementation of pre-contractual measures taken in response to the data subject’s request; |
| (d) | the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the responsible party and a third party; or |
| (e) | the transfer is for the benefit of the data subject, and— |
| (i) | it is not reasonably practicable to obtain the consent of the data subject to that transfer; and |
| (ii) | if it were reasonably practicable to obtain such consent, the data subject would be likely to give it. |
| (2) | For the purpose of this section— |
| (a) | "binding corporate rules" means personal information processing policies, within a group of undertakings, which are adhered to by a responsible party or operator within that group of undertakings when transferring personal information to a responsible party or operator within that same group of undertakings in a foreign country; and |
| (b) | "group of undertakings" means a controlling undertaking and its controlled undertakings. |