Personal information stored outside South Africa is rarely a decision anyone sat down and made. It happens when a payroll package, a school communication app, a survey tool or a cloud backup is switched on, and the servers behind it turn out to be in another country. For employers, HR managers, school administrators and SME owners, the practical question is a plain one: where does our people's information actually go, and can anyone say so with confidence?
A common belief is that this is a technical matter for the IT provider or the software vendor. Section 72 of the Protection of Personal Information Act (POPIA), headed "Transfers of personal information outside Republic", points elsewhere. It places the duty on the responsible party in South Africa, which is the organisation that decides why and how the information is processed. The vendor's terms matter, but the organisation is the one answerable for the decision to use the service.
Personal information outside South Africa: the five grounds in Section 72
The section says that a responsible party in the Republic may not transfer personal information about a data subject to a third party in a foreign country unless one of five grounds applies. In plain terms:
- The recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, substantially similar to the POPIA conditions for lawful processing, including rules on any further transfer onward.
- The data subject consents to the transfer.
- The transfer is necessary for a contract between the data subject and the organisation, or for steps taken at the data subject's request before a contract is concluded.
- The transfer is necessary for a contract concluded in the data subject's interest between the organisation and a third party.
- The transfer is for the data subject's benefit, obtaining consent is not reasonably practicable, and the person would be likely to give it if it were.
Whether a particular arrangement, such as storage with a foreign cloud provider, amounts to a transfer, and which ground would fit, is a legal question that belongs with legal counsel. At the time of writing (October 2026), the guidance notes listed on the Information Regulator's website do not include one on cross-border transfers, so organisations are working from the text of the Act itself.
How to find out where your data goes
What an organisation can do without waiting for anyone is find out what it is actually using. The usual gap is not a missing clause. It is that the privacy notice describes the tools the organisation intended to use, while staff are using others: a free survey form, a messaging app, a personal cloud folder, an email marketing platform added by one department.
How the check works in practice
The working method at Kevin Bishop Consulting treats this as an operationalisation question rather than a documentation one. The list of tools that hold staff, learner or client information is built from what people say they do and, where possible, checked on site. For each tool, the hosting location and the terms that apply are recorded. Each finding is scored before it is discussed, so the conversation starts from a ranked set of remediable starting points rather than a verdict. It is the evidence-against-requirement discipline of an ISO 9001-style audit, applied to personal information, and it suits a Gauteng school or a ten-person firm as well as a larger employer.
One action for this week
One action is enough for this week: ask each department head to list the apps and online services that hold personal information, and to note where each is hosted. Then compare that list with what the organisation's Privacy Policy tells people about who receives their information. The same logic applies to the records a PAIA Section 51 manual must describe: a document is only useful when it matches what the organisation really holds. For organisations that want a starting point on where they stand across both Acts, the POPIA/PAIA Readiness Snapshot is a desktop, self-reported readiness rating.
Related reading: