Protection of Personal Information Act 2013 and data protection for health research in South Africa

The right to privacy is constitutionally protected in South Africa (SA) by virtue of section 14 of the Constitution. As a corollary to that, section 32, which provides for the right of access to information by public and private bodies, also includes a right of access to personal information. The Protection of Personal Information Act [No.4 of 2013] (POPIA) is the first comprehensive data protection regulation to be passed in SA and it gives effect to this constitutional right to privacy. It is due to come into force in 2020 and seeks to regulate the processing of personal information in SA, regulate the flow of personal information across SAs borders, and ensure that any limitations on the right to privacy are justified and aimed at protecting other important rights and interests.