The collection of personal and sensitive data in South Africa is protected by the human rightto privacy, and the ‘Protection of Personal Information Act’. This law is seen as a fundamental right, but not as an absoulute right. This law is not seen as an absolute right because deviations of data protection in certain situations are legitimate. Therefore, decency, justice, and effectiveness shall be guaranteed in the collection of data, and in accordance with ‘Principles of Information Protection’.

This specifies the limitation of the processing and dissemination of data, the indication of the purpose of data collection, the quality of information about what data should be collected, transparency, and insurance on the handling of data, voluntary participation, and accountability. The collection of sensitive data may in this case take place for essential purposes, as well as  in an appropriate form.

The South African Law Reform Institution refers in its discussion paper to the‘protection of privacy and data’ in existing policies, such as the EU Directove, or the US Federal Trade Commission. The definition of sensitive data is also broad, and covers the following areas: ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, information about health and sex life, information on debt, financial situation, criminal history,and social benefits.

The processing of such sensitive data is subject to prohibition, unless the person concerned has given consent to further processing. Processing should only be carried out in the context made known to the concerned person. In case of inability of the subject to agree to the processing of data (for example, in the collection of blood, and investigations during an accident) the analyzing of data should only be carried out in the interest of the subject, and of a compelling magnitude.