Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998 26 No. 37067 GOVERNMENT GAZETTE, 26 November 2013 Act No. 4 of 2013 Protection of Personal Information Act, 2013 26 (c) collection of the information from another source would not prejudice a legitimate interest of the data subject; (d) collection of the information from another source is necessary— (i) to avoid prejudice to the maintenance of the law by any public body, including the prevention, detection, investigation, prosecution and 5 punishment of offences; (ii) to comply with an obligation imposed by law or to enforce legislation concerning the collection of revenue as defined in section 1 of the South African Revenue Service Act, 1997 (Act No. 34 of 1997); (iii) for the conduct of proceedings in any court or tribunal that have 10 commenced or are reasonably contemplated; (iv) in the interests of national security; or (v) to maintain the legitimate interests of the responsible party or of a third party to whom the information is supplied; (e) compliance would prejudice a lawful purpose of the collection; or 15 (f) compliance is not reasonably practicable in the circumstances of the particular case. Condition 3 Purpose specification Collection for specific purpose 20 13. (1) Personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party. (2) Steps must be taken in accordance with section 18(1) to ensure that the data subject is aware of the purpose of the collection of the information unless the provisions of section 18(4) are applicable. 25 Retention and restriction of records 14. (1) Subject to subsections (2) and (3), records of personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed, unless— (a) retention of the record is required or authorised by law; (b) the responsible party reasonably requires the record for lawful purposes related to its functions or activities; (c) retention of the record is required by a contract between the parties thereto; or (d) the data subject or a competent person where the data subject is a child has consented to the retention of the record. (2) Records of personal information may be retained for periods in excess of those contemplated in subsection (1) for historical, statistical or research purposes if the responsible party has established appropriate safeguards against the records being used for any other purposes. (3) A responsible party that has used a record of personal information of a data subject to make a decision about the data subject, must— (a) retain the record for such period as may be required or prescribed by law or a code of conduct; or (b) if there is no law or code of conduct prescribing a retention period, retain the record for a period which will afford the data subject a reasonable opportunity, taking all considerations relating to the use of the personal information into account, to request access to the record. (4) A responsible party must destroy or delete a record of personal information or de-identify it as soon as reasonably practicable after the responsible party is no longer authorised to retain the record in terms of subsection (1) or (2). 30 35 40 45 50