POPIA 12: Condition 2, processing limitation: collection directly from the data subject

Personal information must be collected directly from the data subject unless it is in or derived from a public record or deliberately made public by the data subject; the data subject or competent person consented to collection from another source; collection from another source would not prejudice a legitimate interest of the data subject; collection from another source is necessary for the maintenance of the law, a legal obligation or revenue legislation, court proceedings, national security or the legitimate interests of the responsible party or a third party; compliance would prejudice a lawful purpose of the collection; or compliance is not reasonably practicable.