Section 11 of PROTECTION OF PERSONAL INFORMATION ACT (POPIA)

Consent, justification and objection

1. Personal information may only be processed if:
   • the data subject or a competent person where the data subject is a child consents to the processing;
   • processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party;
   • processing complies with an obligation imposed by law on the responsible party;
   • processing protects a legitimate interest of the data subject;
   • processing is necessary for the proper performance of a public law duty by a public body; or
   • processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.
2. The responsible party bears the burden of proof for the data subject’s or competent person’s consent.
   • The responsible party bears the burden of proof for the data subject’s or competent person’s consent.
   • The data subject or competent person may withdraw their consent at any time.
3. A data subject may object, at any time, to the processing of personal information:
   • in terms of subsection (1)(d) to (f), unless legislation allows it; or
   • for direct marketing purposes not covered by section 69.
4. If a data subject has objected, the responsible party may no longer process the information.