South Africa: Implemented data transfer restrictions in Protection of Personal Information Act (POPIA) after grace period

The operative provisions of the Protection of Personal Information Act (2013) including restrictions on cross-border data transfers come into effect after a one-year grace period following proclamation No. R21 in 2019. Specifically, Section 72 exposes the conditions through which personal information about a data subject can be transferred to a third party in a foreign country. Such conditions include compliance with the law, the data subject's consent, and the performance of a contract between the data subject and the responsible party or in the interest of the data subject.