Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998 24 No. 37067 GOVERNMENT GAZETTE, 26 November 2013 Act No. 4 of 2013 Protection of Personal Information Act, 2013 24 determination of the purpose and means of the processing and during the processing itself. Condition 2 Processing limitation Lawfulness of processing 5 9. Personal information must be processed— (a) lawfully; and (b) in a reasonable manner that does not infringe the privacy of the data subject. Minimality 10. Personal information may only be processed if, given the purpose for which it is 10 processed, it is adequate, relevant and not excessive. Consent, justification and objection 11. (1) Personal information may only be processed if— (a) the data subject or a competent person where the data subject is a child consents to the processing; (b) processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party; (c) processing complies with an obligation imposed by law on the responsible party; (d) processing protects a legitimate interest of the data subject; (e) processing is necessary for the proper performance of a public law duty by a public body; or (f) processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied. (2) (a) The responsible party bears the burden of proof for the data subject’s or competent person’s consent as referred to in subsection (1)(a). (b) The data subject or competent person may withdraw his, her or its consent, as referred to in subsection (1)(a), at any time: Provided that the lawfulness of the processing of personal information before such withdrawal or the processing of personal information in terms of subsection (1)(b) to (f) will not be affected. (3) A data subject may object, at any time, to the processing of personal information— (a) in terms of subsection (1)(d) to (f), in the prescribed manner, on reasonable grounds relating to his, her or its particular situation, unless legislation provides for such processing; or (b) for purposes of direct marketing other than direct marketing by means of unsolicited electronic communications as referred to in section 69. (4) If a data subject has objected to the processing of personal information in terms of subsection (3), the responsible party may no longer process the personal information. 15 20 25 30 35 Collection directly from data subject 12. (1) Personal information must be collected directly from the data subject, except 40 as otherwise provided for in subsection (2). (2) It is not necessary to comply with subsection (1) if— (a) the information is contained in or derived from a public record or has deliberately been made public by the data subject; (b) the data subject or a competent person where the data subject is a child has 45 consented to the collection of the information from another source;