Section 4 Lawful processing of personal information

  1. The conditions for the lawful processing of personal information by or for a responsible party are the following:
    1. ‘‘Accountability’’, as referred to in section 8;
    2. ‘‘Processing limitation’’, as referred to in sections 9 to 12;
    3. ‘‘Purpose specification’’, as referred to in sections 13 and 14;
    4. ‘‘Further processing limitation’’, as referred to in section 15;
    5. ‘‘Information quality’’, as referred to in section 16;
    6. ‘‘Openness’’, as referred to in sections 17 and 18;
    7. ‘‘Security safeguards’’, as referred to in sections 19 to 22; and
    8. ‘‘Data subject participation’’, as referred to in sections 23 to 25.
  2. The conditions, as referred to in subsection (1), are not applicable to the processing of personal information to the extent that such processing is—
    1. excluded, in terms of section 6 or 7, from the operation of this Act; or
    2. exempted in terms of section 37 or 38, from one or more of the conditions concerned in relation to such processing.
  3. The processing of the special personal information of a data subject is prohibited in terms of section 26, unless the—
    1. provisions of sections 27 to 33 are applicable; or
    2. Regulator has granted an authorisation in terms of section 27(2), in which case, subject to section 37 or 38, the conditions for the lawful processing of personal information as referred to in Chapter 3 must be complied with.
  4. The processing of the personal information of a child is prohibited in terms of section 34, unless the—
    1. provisions of section 35(1) are applicable; or
    2. Regulator has granted an authorisation in terms of section 35(2), in which case, subject to section 37, the conditions for the lawful processing of personal information as referred to in Chapter 3 must be complied with.
  5. The processing of the special personal information of a child is prohibited in terms of sections 26 and 34 unless the provisions of sections 27 and 35 are applicable in which case, subject to section 37, the conditions for the lawful processing of personal information as referred to in Chapter 3 must be complied with.
  6. The conditions for the lawful processing of personal information by or for a responsible party for the purpose of direct marketing by any means are reflected in Chapter 3, read with section 69 insofar as that section relates to direct marketing by means of unsolicited electronic communications.
  7. Sections 60 to 68 provide for the development, in appropriate circumstances, of codes of conduct for purposes of clarifying how the conditions referred to in subsection (1), subject to any exemptions which may have been granted in terms of section 37, are to be applied, or are to be complied with within a particular sector.

Section 69 Direct marketing by means of unsolicited electronic communications

  1. The processing of personal information of a data subject for the purpose of direct marketing by means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail is prohibited unless the data subject—
    1. has given his, her or its consent to the processing; or
    2. is, subject to subsection (3), a customer of the responsible party.
    1. A responsible party may approach a data subject—
      1. whose consent is required in terms of subsection (1)(a); and
      2. who has not previously withheld such consent,
      3. only once in order to request the consent of that data subject.
    2. The data subject’s consent must be requested in the prescribed manner and form.
  2. A responsible party may only process the personal information of a data subject who is a customer of the responsible party in terms of subsection (1)(b)—
    1. if the responsible party has obtained the contact details of the data subject in the context of the sale of a product or service;
    2. for the purpose of direct marketing of the responsible party’s own similar products or services; and
    3. if the data subject has been given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its electronic details—
      1. at the time when the information was collected; and
      2. on the occasion of each communication with the data subject for the purpose of marketing if the data subject has not initially refused such use.
  3. Any communication for the purpose of direct marketing must contain—
    1. details of the identity of the sender or the person on whose behalf the communication has been sent; and
    2. an address or other contact details to which the recipient may send a request that such communications cease.
  4. ‘‘Automatic calling machine’’, for purposes of subsection (1), means a machine that is able to do automated calls without human intervention.
1Address