Protection of Personal Information Act 2013 and data protection for health research in South Africa

• The Protection of Personal Information Act (POPIA) [No.4 of 2013] is the first comprehensive data protection regulation to be passed in South Africa and it gives effect to the right to informational privacy derived from the constitutional right to privacy.
• It is due to come into force in 2020, and seeks to regulate the processing of personal information in South Africa, regulate the flow of personal information across South Africa’s borders, and ensure that any limitations on the right to privacy are justified and aimed at protecting other important rights and interests.
• Although it was not drafted with health research in mind, POPIA will have an impact on the sharing of health data for research, in particular biorepositories.
• It is now timely to consider the impact of POPIA on biorepositories, and the necessary changes to their access and sharing arrangements prior to POPIA coming into force.

This is a pre-copyedited, author-produced version of an article accepted for publication in International Data Privacy Law Journal following peer review. The version of record Ciara Staunton, Rachel Adams, Dominique Anderson, Talishiea Croxton, Dorcas Kamuya, Marianne Munene, Carmen Swanepoel, Protection of Personal Information Act 2013 and data protection for health research in South Africa, International Data Privacy Law, Volume 10, Issue 2, May 2020, Pages 160–179, is available online at: URL: https://academic.oup.com/idpl/article/10/2/160/5715399 and DOI: https://doi.org/10.1093/idpl/ipz024 on the OUP website