POPIA 72: Transfers of personal information outside the Republic

What does 72 require?

A responsible party may not transfer personal information to a third party in a foreign country unless the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection that upholds principles substantially similar to the conditions for lawful processing and restricts onward transfer in terms substantially similar to this section; the data subject consents; the transfer is necessary for a contract with the data subject or pre-contractual measures at their request; it is necessary for a contract in the data subject's interest between the responsible party and a third party; or it is for the data subject's benefit where consent is not reasonably practicable to obtain and would likely be given. Binding corporate rules are group-wide processing policies adhered to when transferring within the group. Transfers of special or children's information to a country without adequate protection additionally require prior authorisation (57).