PROTECTION OF PERSONAL INFORMATION ACT, 4 OF 2013: REGULATIONS UNDER SECTION 112(2)(C) OF THE ACT
Notice Title: Protection of Personal Information Act, 4 of 2013 (“POPIA”): Regulations under Section 112(2)(c) of the Act
Government Notice: GN 7198 in GG 54268 on 6 March 2026
Commencing date: 6 March 2026
The Chairperson of the Information Regulator, under section 112(2)(c) of the POPIA, published the Regulations relating to the Processing of Data Subjects’ Health Information by Certain Responsible Parties, 2026, for implementation.
The primary purpose of these Regulations is to:
- Assist responsible parties to interpret section 32(6) of the POPIA correctly;
- provide better transparency to data subjects on the manner in which their health information may be used; and
- provide a framework to the Information Regulator regarding the enforcement mechanism for the processing of health information of data subjects as provided for in section 32(6) of the POPIA.
The Regulations apply to the processing of health information by the following responsible parties and applicable operators:
- Insurance Companies;
- Medical Schemes;
- Medical Scheme Administrators;
- Managed Healthcare Organisations;
- Administrative Bodies;
- Pension Funds;
- Employers; and
- Institutions working for employers, administrative bodies or pension funds
For a copy of the Government Gazette Notice click here: Protection of Personal Information Act: Regulations (English / Afrikaans)
For more information or assistance please contact Gert van der Waal at gert@shangoni.co.za.
