The regulator will publish a guidance note on cross-border transfers to and from South Africa in terms of POPIA. They will not wait for the finalisation of the African Continental Free Trade Agreement. They have been consulting with other authorities, including the ICO and the EU. This guidance note will help organisations transfer data and use cloud computing.

What the guidance note on cross-border transfers covers

We don’t yet know what the regulator plans to cover in this guidance note, but some topics come to mind.

  1. Adequacy findings by South Africa about other countries. And other countries about South Africa.
  2. Guidance on the grounds for lawful transfer set out in section 72.
  3. How to lawfully transfer personal information outside of South Africa.
  4. How a responsible party assesses the adequacy of another country.
  5. The need to conduct transfer impact assessments.
  6. Obtaining prior authorisation for transfers of special and children’s personal information.

When will it be published? What is the timeline?

We don’t know, but we expect it before 31 March 2024.

What is the status of the guidance note on cross-border transfers?

The guidance note on cross-border transfers cannot contradict POPIA itself

Generally a guidance note assists in the interpretation of POPIA. It is advisory in nature and are not binding on the regulator or any other party. It does not amend or supplement the legal effect or interpretation of POPIA. If there is a conflict of meaning between POPIA (or the POPIA regulations) and the guidance note, POPIA prevails. The guidance note does not constitute legal advice.

Actions you can take