The 8 Conditions for Lawful Processing, Explained With Examples

The eight conditions are the whole Act

Chapter 3 of POPIA sets out eight conditions for the lawful processing of personal information. If you satisfy all eight, you are substantially compliant. Everything else in the Act is either a definition, an exception, or a rule about how it is enforced.

The problem is that the conditions have dry statutory names that tell you almost nothing. "Further processing limitation" does not explain itself. This article takes each one in turn and says what it actually asks of a South African business, with an example of getting it wrong.

Condition 1: Accountability (section 8)

What it says. The responsible party must ensure the conditions are complied with at the time of determining the purpose and means of processing, and during the processing itself.

What it means. Compliance is your job, actively and continuously, and you must be able to show it. This is why documentation matters: a privacy policy, a record of what you process, retention rules written down, and evidence of consent where you rely on it. If the Regulator asks how you comply and the answer is "we just do", you have failed this condition regardless of how careful you actually are.

Getting it wrong. A business handles data carefully in practice, but has nothing written down. A complaint arrives and there is no way to demonstrate any of it.

Condition 2: Processing limitation (sections 9 to 12)

What it says. Process lawfully and in a manner that does not infringe privacy. Processing must be adequate, relevant and not excessive. You need one of the six grounds in section 11, and you should collect directly from the data subject.

What it means. Three separate ideas live here.

Minimality (section 10): take only what you need. If your newsletter signup asks for a physical address, ask yourself what you post to people.

A lawful ground (section 11): consent, contractual necessity, a legal obligation, protecting someone's legitimate interests, a public law duty, or your own legitimate interests. Consent is only one of six, and often not the best one, because it can be withdrawn.

Collect directly (section 12): get information from the person, not from third parties, unless an exception applies such as the information being in a public record or collection from elsewhere being necessary and not prejudicial.

Getting it wrong. Buying a mailing list. You did not collect directly, you have no lawful ground for marketing to those people, and section 69 makes the marketing itself unlawful.

Condition 3: Purpose specification (sections 13 and 14)

What it says. Collect for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party. Do not keep records longer than necessary for that purpose.

What it means. Decide why you want something before you collect it, tell the person, and then stop keeping it when that reason expires. Section 14 lists the exceptions permitting longer retention: another law requires it, a contract requires it, the person consented, or it is for research with safeguards.

Section 14(4) then requires you to destroy, delete or de-identify records once the period ends, in a way that prevents reconstruction.

Getting it wrong. Keeping every CV you have ever received. The purpose ended when each role was filled, and no exception covers indefinite retention. See POPIA and hiring.

Condition 4: Further processing limitation (section 15)

What it says. Further processing must be compatible with the purpose for which the information was originally collected.

What it means. This is the condition people search for by name and understand least. It governs what happens when you want to use information you already hold for something new. The test is compatibility, and section 15(2) lists factors: the relationship between the new purpose and the original one, the nature of the information, the consequences for the person, how it was collected, and any contractual restrictions.

Some further processing is expressly compatible under section 15(3), including where the person consents, where it is necessary to prevent a serious threat, or for historical, research or statistical purposes.

Getting it wrong. A customer gives you their email to receive a delivery notification. You add them to your monthly newsletter. The new purpose is not compatible with the original one, and you have also breached section 69.

Condition 5: Information quality (section 16)

What it says. Take reasonably practicable steps to ensure information is complete, accurate, not misleading and updated where necessary, having regard to the purpose.

What it means. The standard scales with the stakes. A misspelt name on a newsletter list is low risk. An incorrect payment default recorded against someone's name is high risk, and the effort required to keep it accurate is correspondingly greater.

Getting it wrong. Continuing to send debt collection letters to an address you have been told twice is wrong, to a person who settled the account.

Condition 6: Openness (sections 17 and 18)

What it says. Maintain documentation of all processing operations, and notify the data subject when collecting their information.

What it means. Section 17 ties into the PAIA manual requirement. Section 18 is the one most businesses interact with daily: at the point of collection, tell the person what you are collecting, why, whether supplying it is voluntary or mandatory, the consequences of not supplying it, who you might share it with, and their rights.

That is what a privacy policy is for, and why "we take your privacy seriously" is not one.

Getting it wrong. A contact form that collects a phone number with no explanation of why, and a privacy policy that never mentions phone numbers.

Condition 7: Security safeguards (sections 19 to 22)

What it says. Secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures. Ensure operators do the same, under a written contract. Notify breaches.

What it means. Section 19 requires you to identify reasonably foreseeable risks, establish safeguards, verify they are effective, and update them. The Act does not name technologies, which means the standard moves as the threats do.

Sections 20 and 21 extend the duty to anyone processing on your behalf and require that written contract. Section 22 requires breach notification to the Regulator and to affected people.

Getting it wrong. Using a cloud CRM with no signed agreement, no idea where it stores data, and shared login credentials among five staff.

Condition 8: Data subject participation (sections 23 to 25)

What it says. A person may request confirmation of whether you hold information about them, request the record itself, and request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained.

What it means. You need a process. Requests for access are made under PAIA, generally answered within 30 days. When you correct or delete something, section 24(3) requires you to notify third parties you shared it with, where reasonably practicable.

Getting it wrong. A customer asks what you hold about them and the request bounces between three people for two months before someone answers.

How the conditions fit together

Read in order, the eight conditions describe a life cycle. Decide why you need something and take only that much (2 and 3). Tell the person and keep a record (6). Keep it accurate and secure while you have it (5 and 7). Only reuse it for compatible purposes (4). Let the person see and correct it (8). Delete it when the reason expires (3). Be able to demonstrate all of it (1).

Most compliance failures are a failure of one specific condition, and naming which one usually makes the fix obvious.

For the full obligation list including the parts outside Chapter 3, see POPIA requirements. If you want to know where your website stands, the free checklist takes about two minutes, and POPIA Ready generates the documents conditions 6 and 7 expect you to have.

A plain-English summary of Chapter 3 as at July 2026, not legal advice.