Consent, justification and objection

Consent, justification and objection

11. (1) Personal information may only be processed if—
(a) the data subject or a competent person where the data subject is a child
consents to the processing;
(b) processing is necessary to carry out actions for the conclusion or performance
of a contract to which the data subject is party;
(c) processing complies with an obligation imposed by law on the responsible
party;
(d) processing protects a legitimate interest of the data subject;
(e) processing is necessary for the proper performance of a public law duty by a
public body; or
(f) processing is necessary for pursuing the legitimate interests of the responsible
party or of a third party to whom the information is supplied.

(2) (a) The responsible party bears the burden of proof for the data subject’s or
competent person’s consent as referred to in subsection (1)(a).
(b) The data subject or competent person may withdraw his, her or its consent, as
referred to in subsection (1)(a), at any time: Provided that the lawfulness of the
processing of personal information before such withdrawal or the processing of personal
information in terms of subsection (1)(b) to (f) will not be affected.

(3) A data subject may object, at any time, to the processing of personal information—
(a) in terms of subsection (1)(d) to (f), in the prescribed manner, on reasonable
grounds relating to his, her or its particular situation, unless legislation
provides for such processing; or
(b) for purposes of direct marketing other than direct marketing by means of
unsolicited electronic communications as referred to in section 69.

(4) If a data subject has objected to the processing of personal information in terms of subsection (3), the responsible party may no longer process the personal information.

Please follow and like us:

© 2022. Information Regulator South Africa / Terms and Conditions