At the end of last year, the Court of Justice of the European
Union ruled that the EU Safe Harbour Decision (permitting the
transfer of personal data to the US) was invalid as the US did not
provide an adequate level of protection of personal data within the
meaning of Article 25 of Directive 95/46.
The Protection of Personal Information Act 4 of 2013 (POPI)
includes similar "safe harbour" language for the
cross-border transfer of personal information. In this insight we
provide a brief overview of the requirements to transfer personal
information to a third party in a foreign country under POPI.
Introduction
POPI is the first piece of legislation in South Africa that
deals specifically and fully with the protection of personal
information. The commencement of POPI (the date of which is yet to
be proclaimed) will require a complete reform of the manner in
which entities process personal information to ensure compliance
with POPI, particularly the transfer of such
