The Protection of Personal Information Act 4 of 2013 in the Context of Health Research: Enabler of Privacy Rights or Roadblock?




POPIA, health research, broad consent, specific consent, data privacy, exemptions to POPIA


Data is an exceptionally valuable asset – it is a fundamental part of the information age and is widely regarded as the world's most valuable resource. A key issue that has caused some debate in South Africa in recent times relates to the Protection of Personal Information Act 4 of 2013 (POPIA), and whether the Act requires broad or specific consent in the context of health research. The primary purpose of this article will be to answer the following question: does POPIA require broad or specific consent from persons who take part in health research? In a health research context, POPIA must be considered together with, inter alia, the National Health Act 61 of 2003 (NHA), and the Health Professions Act 56 of 1974 (HPA). As a point of departure, in terms of the NHA, health research requires the informed consent of participants. Informed consent has been a part of South African law for almost one hundred years, and gives effect to an individual's dignity and autonomy. The NHA does not directly distinguish between types of consent, but the Department of Health's second edition of Ethics in Health Research: Principles, Processes and Structures (the DoH Ethical Guidelines) does. The practice of broad consent is not only endorsed by the DoH Ethical Guidelines but encouraged. However, unlike the medical-legal framework, POPIA – which should be referred to as the privacy framework, or "privacy layer" in relation to data compliance in health research – requires consent to be specific as well as informed. If one considers the applicable sections of POPIA, and South Africa's interpretive tools and jurisprudence, it is apparent that consent in health research should as a matter of best practice be specific.


Download data is not yet available.


Metrics Loading ...

Author Biography

Lee Swales, University of KwaZulu-Natal

Lecturer at University of kwaZulu-Natal.

Practicing attorney at Thomson Wilks Inc.




Adams R et al 2021 "POPIA Code of Conduct for Research" South African Journal of Science DOI:

Britz R and Le Roux-Kemp A 2012 "Voluntary informed consent and good clinical practice for clinical research in South Africa: Ethical and legal perspectives" SAMJ 746–748 DOI:

Burchell J 2009 "The Legal Protection of Privacy in South Africa: A transplantable hybrid" EJCL 1–26

Burns Y and Burger-Smidt A A Commentary on the Protection of Personal Information Act (LexisNexis Durban 2018)

Buthelezi C 2013 "Let false light (publicity) shine forth in South African law" Dejure

Chima SC 2013 "Evaluating the quality of informed consent and contemporary clinical practices by medical doctors in South Africa: an empirical study" BMC Medical Ethics DOI:

De Stadler P and Esselaar Y A Guide to the Protection of Personal Information Act (Juta 2015)

F Dankar et al 2020 "Dynamic-informed consent: A potential solution for ethical dilemmas in population sequencing initiatives" Computational and Structural Biotechnology Journal 913–921 DOI:

Larsen C Data privacy protection in South Africa: an analysis of vicarious liability in light of the Protection Of Personal Information Act 4 of 2013 ("POPIA"). (LLM-dissertation University of KwaZulu-Natal 2019)

Manyonga H et al 2014 "From informed consent to shared decision-making" SAMJ 561–562 DOI:

McQuoid-Mason D "Privacy" in Woolman S and Bishop M (eds) Constitutional Law of South Africa (Juta Cape Town 2008) 38-01–38-02

McQuoid-Mason D 2000 "Invasion of privacy: Common law v Constitutional delict – does it make a difference?" Acta Juridica

Millard D and Bascerano EG 2016 "Employers' statutory vicarious liability in terms of the Protection of Personal Information Act" PELJ 5–6 DOI:

Moore W and Slabbert M 2013 "Medical information therapy and medical malpractice litigation in South Africa" SAJBL 60–63 DOI:

Naude A and Papadopoulos S 2016 "Data protection in South Africa: The Protection of Personal Information Act 4 of 2013 in light of recent international developments (Part 1)" THRHR 55–56

Neethling J 2005 "The concept of privacy in South African law" SALJ 18–28

Neethling J 2012 "Features of the Protection of Personal Information Bill, 2009 and the law of delict" THRHR 241

Neethling J, Potgieter JM and Visser PJ Neethling’s Law of Personality (Butterworths Durban 2005) DOI:

Nordling L 2019 "South African law may impede human health research" Science 802 DOI:

Roos A "Data Privacy Law" in van der Merwe DP et al (eds) Information and Communications Technology Law (LexisNexis Durban 2016)

Roos A 2006 "Core principles of data protection law" CILSA 102–130

Roos A 2007 "Data Protection: Explaining the international backdrop and evaluating the current South African position" SALJ 400–433

Roos A 2020 "The European Union's General Data Protection Regulation (GDPR) And Its Implications For South African Data Privacy Law : An Evaluation Of Selected 'Content Principles'" CILSA 1–37 DOI:

Staunton C and De Stadler E 2019 "Protection of Personal Information Act No 4 of 2013: Implications for biobanks" SAMJ 232–234 DOI:

Staunton C et al 2019 "Safeguarding the future of genomic research in South Africa: Broad consent and the Protection of Personal Information Act No 4 of 2013" SAMJ 468–470 DOI:

Stein C 2020 "Consent in health research with incapacitated adults in a time of pandemic: The National Health Research Ethics Council needs to urgently reassess its guidelines" SAJBL 29–33

Thaldar D and Townsend B 2020 "Genomic research and privacy: A response to Staunton et al" SAMJ 172–174 DOI:

Townsend BA and Thaldar DW 2019 "Navigating uncharted waters: biobanks and informational privacy in South Africa" SAJHR 29–350 DOI:

Young Privacy (John Wiley Chichester 1978)


Consumer Protection Act 68 of 2008

Electronic Communications and Transactions Act 25 of 2002

National Credit Act 32 of 2005

National Health Act 61 of 2003

Promotion of Access to Information Act 2 of 2000

Protection of Personal Information Act 4 of 2013

Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002

Government publications

GN 10173 in GG 37544 of 11 April 2014

GN 11136 in GG 43461 of 22 June 2020

GN 1383 GG 42110 of 14 December 2018

GN 719 in GG 41781 of 20 July 2018

GN 912 in G 37067 of 26 November 2013

GN R719 in GG 38000 of 19 September 2014

SALRC 2009 Discussion Paper 109 (Project 124) Privacy and Data Protection

SALRC 2009 Issue paper 24 (Project 124) Privacy and data protection

SALRC 2009 Project 124: Privacy and Data Protection

Case law

Akoo v Master of the High Court [2012] ZAKZPHC 45

Bato Star Fishing (Pty) Ltd v Minister of Environmental Affairs and Tourism 2004 (4) SA 490 (CC)

Bernstein v Bester NO 1996 (2) SA 751 (CC)

Bertie Van Zyl (Pty) Ltd v Minister for Safety and Security 2010 (2) SA 181 (CC)

Castell v De Greef 1994 (4) SA 408 (C)

Centre for Child Law v Media 24 Limited 2020 (4) SA 319 (CC)

Investigating Directorate: Serious Economic Offences v Hyundai Motor Distributors (Pty) Ltd 2001 (1) SA 545 (CC)

Jansen Van Vuuren NO v Kruger 1993 (4) SA 842 (A)

Kidson v South African Associated Newspapers 1957 (3) SA 461 (W)

Mistry v Interim National Medical and Dental Council 1998 (4) SA 1127 (CC)

National Coalition for Gay and Lesbian Equality v Minister of Justice 1999 (1) SA 6 (CC)

National Media Limited v Jooste 1996 (3) SA 262 (SCA)

O'Keeffe v Argus Printing and Publishing Co Ltd 1954 (3) SA 244 (C)

Richter v Estate Hamman 1976 (3) SA 226 (C)

Stoffberg v Elliott 1923 CPD 148

Stopforth v Minister of Justice 2000 (1) SA 113 (SCA)

Universiteit van Pretoria v Tommie Meyer Films (Edms) Bpk 1977 (4) SA 376 (T)

Internet sources

Bhageshpur K 2019 Forbes accessed 18 May 2021

HPCSA accessed 18 May 2021

Information Regulator accessed 18 May 2021

LII accessed 18 May 2021

National Human Genome Research Institute accessed 18 May 2021

Nolo accessed 18 May 2021

Parkins D 2017 The Economist accessed 18 May 2021

SA DoH 2015,%20Processes%20and%20Structures%202nd%20Ed.pdf accessed 18 May 2021

SA DoH 2018 accessed 18 May 2021

SA MRC 2018 accessed 18 May 2021

South African Medical Association accessed 18 May 2021

Stevenson S 2019 accessed 18 May 2021



How to Cite

Swales, L. (2022). The Protection of Personal Information Act 4 of 2013 in the Context of Health Research: Enabler of Privacy Rights or Roadblock?. Potchefstroom Electronic Law Journal, 25, (Published 9 March 2022) pp 1 – 32.




Similar Articles

1 2 3 4 5 6 7 8 9 10 > >> 

You may also start an advanced similarity search for this article.