Cross-Border Data Transfers Under POPIA: A Practical Guide

You can send personal information out of South Africa under POPIA, but only if one of the grounds in section 72 applies. For most small businesses, that means one of two things. Either the foreign recipient is bound by a law, rules or a contract that protects the information to a standard similar to POPIA, or the person the information is about has given proper consent. You don’t need the Information Regulator’s permission for everyday transfers.

This matters more than most owners think. If you use a cloud accounting package, an email marketing tool, an overseas freelancer or a payroll provider abroad, you are probably already transferring personal information across a border. This guide explains the reasoning behind the rule and the questions to ask before you sign up for the next tool.

Key takeaways

• Section 72 of POPIA allows a transfer abroad when the recipient is bound by adequate protection, or when consent, contract necessity or the data subject’s benefit applies.
• Prior authorisation from the Information Regulator is needed only in narrow, higher-risk cases involving special personal information or children’s information.
• You stay accountable for the information after it leaves South Africa, so the contract with the foreign provider matters as much as the tool itself.
• Consent must be voluntary, specific and informed. A line buried in a long privacy policy is a weak foundation.
• Keep a simple record of each foreign provider, what data goes to them and which ground you rely on.

Table of Contents

• What counts as a cross-border transfer
• Why the rule exists
• The grounds in section 72
• Relying on a contract with the foreign provider
• Getting consent right
• When you need the Information Regulator’s approval
• A five-step routine for every new foreign tool or supplier
• Questions to ask before you sign
• Where this fits in your wider POPIA readiness
• Building legal readiness without starting from scratch
• Frequently asked questions
• Sources

What counts as a cross-border transfer

POPIA protects “personal information”: anything that identifies a person, such as names, ID numbers, email addresses, payment details or employment records. A “transfer” happens when you hand that information to a third party in a foreign country. POPIA doesn’t define the word, a point lawyers have pointed out in commentary and debated, so the safest approach is to read it broadly.

The rule itself is short. Section 72 says a responsible party in South Africa may not transfer personal information to a third party in a foreign country unless one of a closed list of grounds is met. The “responsible party” is you, the business that decides why and how the information is used.

Three everyday scenarios show how often this comes up:

• Thandi, a freelance designer in Durban, stores client contact details in a project tool hosted in the United States and shares files with a contractor in Portugal.
• Sipho and Naledi, who run a start-up in Johannesburg, send customer emails through a marketing platform whose servers are in Europe.
• A Cape Town SME with 40 staff uses an international HR system that keeps employee records in a data centre abroad.

None of them is doing anything unusual. They simply need to know which ground they are standing on.

Why the rule exists

The logic is simple. POPIA gives people rights over their information. If a South African business could ship that information to a country with no privacy protection, those rights would disappear at the border. Section 72 makes sure the protection travels with the information.

The Information Regulator’s materials describe this as a “protection trail”. Wherever the data goes, you remain accountable for its security and integrity. The Regulator’s Code of Conduct for the banking sector spells out how a responsible party must treat recipients abroad. It is written for banks, but the thinking applies to any business.

In practice, you shift your mindset from “sending data” to “managing accountability”. The question isn’t “may I send this abroad?” It is “can I show that this information will still be treated properly once it gets there?”

The grounds in section 72

You need only one of the following. Each one answers a different business situation.

The five grounds follow the wording of the Act as reproduced on popia.co.za, and the Information Regulator’s guidance confirms that these justifications work without prior approval from the Regulator. For the full text, you can also read the Act itself on the Justice Department website.

Relying on a contract with the foreign provider

For most small businesses, the first ground is the most practical. You can’t ask every customer for a fresh consent each time you adopt a new software tool, and the contract grounds only cover transfers that are genuinely necessary. A contract with the provider covers the whole relationship.

Here is the catch. The research behind this guide points to a common mistake: assuming a global provider’s standard terms of service are enough. They often are not. The agreement needs to deal specifically with data protection at a level equivalent to POPIA’s eight conditions. Those conditions cover accountability, processing limitation, purpose specification, further processing, information quality, openness, security safeguards and data subject participation.

A useful agreement with a foreign provider normally covers:

1. Purpose. The provider may use the information only to deliver the service to you.
2. Security. The provider takes appropriate technical and organisational measures, and tells you promptly if something goes wrong.
3. Sub-providers. The provider tells you if it passes the information on, and holds those parties to the same standard.
4. Return or deletion. You can get the information back, or have it deleted, when the relationship ends.
5. Your rights as the responsible party. You can respond to people who ask to see, correct or delete their information.

If the provider’s home country has a privacy law that is substantially similar to POPIA, such as the laws of many European countries, that law can itself be the basis for adequacy. You still need to be able to explain why you think so.

A note on binding corporate rules

POPIA also mentions binding corporate rules, which are internal policies that bind a group of related companies. They are for groups, not for a small business buying software. If your SME has a sister company abroad that handles customer or staff information, such rules or an intra-group agreement may be the right tool. They must be actual working policies, not a document filed away and forgotten.

A practical example

Sipho and Naledi are choosing an email platform. Before they sign up, they ask the vendor three questions: where is the information stored, is there a data processing agreement we can sign, and do you use other companies to process the data? They save the vendor’s answers and the signed agreement in a folder. That folder is their evidence of accountability. It took twenty minutes and it settles the question if a customer, a partner or the Regulator ever asks.

A similar principle applies when you hand work to an external provider in any country. Outsourcing a function, such as payroll, doesn’t outsource your responsibility. As one example of a business explaining the benefits of outsourcing HR and payroll, this Polish accounting firm’s article on outsourcing payroll and personnel administration (in Polish) shows why the arrangement still needs clear terms about who handles employee data and how.

Getting consent right

Consent is the ground owners reach for first, and the one most often done badly. POPIA requires consent to be a voluntary, specific and informed expression of will. The Information Regulator has said so plainly in its enforcement notice against the Department of Basic Education, which also addresses section 72.

What does that mean for your business?

• Be specific. Say that the information will be stored or processed in another country, and name the country where you can.
• Be clear. Put the statement where people will see it, such as at the sign-up form, not on page nine of your terms.
• Make it a real choice. If the person says no, you need a way to serve them without the transfer, or you need another ground.
• Keep a record. Note when and how consent was given, and make withdrawal easy.

Deemed or implied consent is the weak spot. Ticking a box that says “I accept the terms” is not the same as agreeing to a particular overseas transfer. If your customers’ information goes offshore as a core part of your service, a contract-based ground, or a provider agreement, is usually sturdier than consent alone.

Your privacy policy has a job here too, because openness is one of the eight conditions. Our guide to the decisions behind every South African privacy policy explains what to tell people and why.

When you need the Information Regulator’s approval

Many owners assume every foreign transfer needs permission. It doesn’t. Prior authorisation is a narrow requirement. The Regulator’s guidance note on prior authorisation explains that it applies where you plan to transfer special personal information, or the information of children, to a foreign country that does not provide an adequate level of protection.

Special personal information includes things like health, religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, sex life and biometric data. So if you are a small clinic, a coaching practice or an education business and you plan to send such information to a country without adequate protection, pause. Talk to a attorney who specialises in privacy law, and check the Information Regulator’s POPIA pages for the current application process and forms.

If you only transfer general contact and billing details, or if the destination has adequate protection, this requirement generally won’t be your concern. Rules and Regulator processes can change, so confirm the current position before you rely on this summary.

A five-step routine for every new foreign tool or supplier

Turn the legal rule into a habit your team can follow in a few minutes.

1. Map it. List every tool or supplier that holds personal information, and note where each one is based and where it stores data. A simple spreadsheet is enough.
2. Classify it. Is the information general, or is it special personal information or about children? That decides whether you need to look more closely.
3. Choose the ground. For each provider, write down which section 72 ground you rely on: adequate law, a contract, consent or contract necessity.
4. Paper it. Sign a data processing agreement where you rely on the provider’s contract. Keep it with the vendor’s answers.
5. Review it. Revisit the list once a year, and whenever you change provider or add a new use for the data.

When two founders disagree on whether a tool is “safe enough”, this routine replaces opinion with a record.

Questions to ask before you sign

The right questions often matter more than a perfect document. Put these to any foreign provider:

• In which countries is our information stored and processed?
• Will you use other companies to handle it, and will you tell us when that changes?
• What security measures do you apply, and how will you notify us of a problem?
• Can we export or delete our information when we leave?
• Will you sign a data processing agreement that reflects South African requirements?

A good provider answers these easily. A reluctant one is telling you something useful.

Where this fits in your wider POPIA readiness

Cross-border transfers are one piece of a bigger picture. You also need an information officer, a sensible approach to security and a plan for how you collect and use information. Our POPIA compliance guide for small businesses and POPIA compliance checklist walk through the rest, and our page on data security and breaches covers how to protect information once you hold it.

Think of this as part of running a credible, well-run business. Customers, investors and larger corporate clients increasingly ask how you handle information, and a clear answer builds trust.

Building legal readiness without starting from scratch

If you would rather have the legal foundations laid out in one place, PocketAdvisor Legal Toolkits™ are digital boxes that combine expert-led videos, practical workbooks and professionally drafted South African legal agreements. The Start-Ups and Solopreneurs toolkit (R1,495, one-off) focuses on the legal foundations a new business needs. The SME toolkit (R2,495, one-off) covers governance and commercial arrangements for growing businesses. Neither replaces professional advice where your situation is complex, but both help you walk into those conversations better prepared.

Understand the legal foundations your business needs. Explore PocketAdvisor Legal Toolkits™.

Frequently asked questions

Does POPIA stop me from using foreign cloud services?

No. POPIA lets you use them, provided one of the section 72 grounds applies. In practice, that usually means the provider is bound by a law or agreement that gives protection substantially similar to POPIA, or that you have proper consent. You remain accountable for the information wherever it is hosted.

Do I need the Information Regulator’s permission to transfer data abroad?

Not for routine transfers. Prior authorisation applies only where special personal information or children’s information is going to a country without adequate protection. Check the Regulator’s current guidance before relying on this for your own case.

Is a privacy policy notice enough to count as consent?

Usually not on its own. Consent must be voluntary, specific and informed, and the Regulator has rejected deemed or implied consent. Tell people clearly, at the point you collect their information, that it will go abroad.

What does “adequate level of protection” mean?

It means the recipient is subject to a law, binding corporate rules or a binding agreement that effectively upholds principles for processing that are substantially similar to POPIA’s conditions for lawful processing. It also needs to provide similar rules on passing the information on to others.

Does the rule apply to information about people who are not South African?

POPIA is built to protect the rights of South African data subjects, though its reach is wider than citizenship alone. If you handle information of people in other countries, take advice on which laws apply, since other privacy regimes may also apply to you.

Sources

• Section 72, Transfers of personal information outside Republic (POPIA text)
• Information Regulator: Revised guidance note on applications for prior authorisation
• Information Regulator: Enforcement notice, Department of Basic Education
• Information Regulator: Code of Conduct for the banking sector
• Information Regulator: POPIA pages
• Protection of Personal Information Act 4 of 2013, Department of Justice

Recommended

• POPIA Compliance Checklist for Small Business
• POPIA Compliance Small Business South Africa
• POPIA Compliance Small Business South Africa

This article is for educational and informational purposes only. It is not a substitute for professional advice.

Pocket Advisor

See Full Bio