Almost every South African business now sends personal information outside the country. Customer records sit in cloud platforms hosted in Europe or the United States. Payroll runs on international software. Marketing lists are loaded into overseas email tools, and group companies share HR data with head office abroad. Each of these is a cross-border transfer, and the Protection of Personal Information Act 4 of 2013 (POPIA) sets rules for when it is allowed.
The topic is getting more attention. The Information Regulator has signalled in its 2026 engagements with Parliament and stakeholders that it is preparing guidance on transfers of personal information outside South Africa, and it is increasingly issuing infringement notices for POPIA failures. Businesses that have never checked where their data goes should do so now.
This article explains what section 72 of POPIA requires, how it applies to cloud services and suppliers, and the practical steps to take.
What section 72 says
Section 72 of POPIA prohibits a responsible party in South Africa from transferring personal information to a third party in a foreign country unless one of five grounds applies:
- Adequate protection. The recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, substantially similar to POPIA’s conditions for lawful processing, and that includes similar rules on further transfers to other countries.
- Consent. The data subject consents to the transfer.
- Contract with the data subject. The transfer is necessary to perform a contract between the data subject and the responsible party, or to take steps the data subject asked for before concluding one.
- Contract in the data subject’s interest. The transfer is necessary to conclude or perform a contract between the responsible party and a third party that is in the data subject’s interest.
- Benefit of the data subject. The transfer is for the data subject’s benefit, it is not reasonably practicable to obtain consent, and the data subject would be likely to consent if asked.
A responsible party is the business that decides why and how personal information is processed. The rule applies to transfers of information about both individuals and, under POPIA’s definitions, juristic persons such as companies.
Which ground should you rely on?
Adequate protection
For routine transfers to suppliers and group companies, the first ground is usually the most practical. Some destination countries have comprehensive data protection laws, such as those of the European Union and the United Kingdom, which many businesses regard as adequate. South Africa has not, however, published an official list of adequate countries, so the assessment is the responsible party’s to make and document.
Where the foreign law is not clearly adequate, or as an extra safeguard, the business can rely on a binding agreement with the recipient. A well-drafted data transfer agreement or data processing addendum should require the recipient to process the information only for agreed purposes, keep it secure, notify breaches, respect data subjects’ rights, and impose the same obligations on anyone it passes the data to. Multinational groups can use binding corporate rules that apply across all group companies.
Consent and necessity
Consent can work for individual transactions, such as booking a client’s overseas travel, but it is a weak foundation for ongoing business systems. Consent must be voluntary, specific and informed, and the data subject can withdraw it. The contractual necessity grounds are also narrower than they appear: the transfer must be genuinely necessary, not merely convenient.
Cloud services and overseas operators
Using an international cloud provider or software platform usually involves a transfer, because the information is stored on servers outside South Africa. The provider is generally an “operator” under POPIA, meaning it processes information on your behalf. In addition to section 72, sections 20 and 21 require you to have a written contract with every operator that obliges it to keep the information confidential and to maintain appropriate security safeguards, and that requires it to notify you immediately of a suspected breach.
Many large providers offer standard data processing terms. Read them. Check where data is hosted, which sub-processors are used, how breaches are reported and whether the terms give the protection section 72 requires.
Special personal information and children’s information
Higher-risk information carries an extra requirement. Under section 57 of POPIA, a responsible party must obtain prior authorisation from the Information Regulator before transferring special personal information (such as health, biometric, religious or criminal behaviour information) or the personal information of children to a third party in a foreign country that does not provide an adequate level of protection. Health and biometric data in particular are common in HR, insurance and medical technology businesses.
Transparency
Section 18 of POPIA requires you to tell data subjects, where applicable, that you intend to transfer their information to another country and the level of protection it will receive. Your privacy notice should say this in plain language. Your PAIA manual should also describe planned transborder flows.
Consequences of getting it wrong
An unlawful transfer is a breach of POPIA. The Information Regulator can investigate, issue enforcement notices and impose administrative fines of up to R10 million. Data subjects can also claim damages. In practice, the bigger risk is that a breach at an overseas supplier becomes your breach, with the reputational and notification consequences that follow.
Practical steps
- Map your data flows: list every system, supplier and group company that receives personal information outside South Africa.
- For each transfer, identify the section 72 ground you rely on and record your reasoning.
- Assess the destination country’s data protection law and the recipient’s security practices.
- Put written operator agreements and data transfer terms in place, including onward transfer and breach notification obligations.
- Identify any special personal information or children’s information sent abroad and consider whether prior authorisation is needed.
- Update your privacy notice and PAIA manual to disclose cross-border transfers.
- Review new suppliers before signing, not after.
- Watch for the Information Regulator’s guidance on transborder flows and adjust your approach once it is published.
How O’Reilly Law can help
We map cross-border data flows, advise on which section 72 ground applies, draft and negotiate data processing and transfer agreements with suppliers and group companies, prepare prior authorisation applications to the Information Regulator, and update privacy notices and PAIA manuals. We also support businesses dealing with breaches involving overseas service providers.
Contact us to review your international data transfers.
Related reading: Information officers under POPIA and PAIA: duties, registration and reporting · Your business has been hacked: a POPIA survival guide for business owners
This article is general information and not legal advice. Correct as at November 2026.