When does POPIA actually require consent?

Ask a South African small business what POPIA requires and you will usually be told: get consent for everything. Tick boxes went up on websites, consent forms went out to customer databases, and a great many businesses concluded that the Act is a consent statute.

It is not, and the belief causes real problems. Consent is one of six lawful grounds in section 11, the Act ranks none of them above the others, and for most ordinary processing consent is the weakest choice available.

The six grounds

Section 11 permits processing where any one of these applies:

Consent. The data subject consents to the processing.

Necessary for a contract. Processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is a party.

A legal obligation. Processing complies with an obligation imposed by law on the responsible party.

Protecting the data subject's legitimate interest. Processing protects a legitimate interest of the data subject.

A public law duty. Processing is necessary for the proper performance of a public law duty by a public body.

Legitimate interests. Processing is necessary for pursuing the legitimate interests of the responsible party, or of a third party to whom the information is supplied.

You need one. Not all six, and not consent plus another as a belt-and-braces measure.

Why consent is usually the wrong choice

Consent under POPIA must be a voluntary, specific and informed expression of will. Three consequences follow, and each is a reason to avoid it where another ground fits.

It can be withdrawn. A data subject may withdraw consent at any time. If your processing rests on consent alone, withdrawal takes your lawful ground away. That is fine for a newsletter. It is a disaster for the customer records you need to keep in order to honour a warranty or to satisfy the tax authorities.

It must be voluntary. Consent obtained as a condition of receiving a service the person needs, where the processing is not actually necessary for that service, is not genuinely voluntary, and a consent that is not voluntary is not consent.

It must be specific and informed. A single blanket consent covering "processing of my personal information for business purposes" is neither. Consent has to identify what is being processed and why.

Businesses that ask for consent they do not need therefore create an obligation to honour a withdrawal they cannot honour, and rest their compliance on a foundation a customer can remove with one email.

What most processing actually runs on

Work through an ordinary small business and the grounds sort themselves out quickly.

Taking a customer's details to fulfil an order is necessary for the performance of a contract. No consent needed.

Keeping invoices and records for the period tax and companies legislation requires is compliance with a legal obligation. No consent needed, and consent could not override the obligation anyway.

Employee payroll, PAYE, UIF and the Compensation Fund are legal obligations. No consent needed.

Fraud prevention, debt collection, ordinary business administration and securing your premises typically rest on legitimate interests.

Marketing to existing customers is where it gets specific, because direct marketing by electronic means has its own rule in section 69 and is not governed by section 11 alone. Our guide on sending marketing emails and SMS under POPIA deals with that separately, because that is a context where consent genuinely does most of the work.

Legitimate interests is not a loophole

Relying on legitimate interests is not a way of avoiding the Act. It requires the processing to be necessary for pursuing that interest, which means you have to be able to say what the interest is, why the processing serves it, and why it could not reasonably be achieved in a less intrusive way.

It also comes with a consequence consent does not have: where you rely on legitimate interests, the data subject has a right to object on reasonable grounds relating to their particular situation. If they object and you have no overriding basis to continue, you stop.

Written down, that assessment takes a page. Not writing it down is the most common gap in a POPIA file, because it means that when the Information Regulator asks on what basis you were processing, there is nothing to hand them but an assertion.

What this means for your paperwork

Three practical consequences.

Your privacy notice should state the grounds, not just promise to be careful. For each category of processing, say what you do, why, and on which section 11 ground. That document is the first thing anyone will ask for.

Stop asking for consent you do not need. Every unnecessary consent is a future withdrawal you will have to process, and it muddies the question of what you were actually relying on.

Do not describe legal obligations as choices. A form that asks an employee to consent to PAYE deductions misdescribes the position and invites an argument about what happens when they say no.

Our POPIA compliance checker works through the main obligations for a small business, and our guide on whether POPIA applies to your business at all is the sensible place to start if you are not sure you are caught.

When you do need consent, get it properly

Where consent genuinely is the right ground, the quality of it decides whether it is worth anything.

Ask separately for each purpose. One tick box covering marketing, profiling and sharing with partners is not specific. Three are.

Do not bundle it with the terms and conditions. Consent buried in a document the customer had to accept in order to transact is difficult to describe as voluntary.

Say who and what. The person consenting should be able to tell, from what is in front of them, what information is being processed, by whom, and for what.

Record when and how it was given. A consent you cannot evidence is a consent you do not have. Store the timestamp, the wording that was shown, and the version of the notice in force at the time. Wording changes, and proving what somebody agreed to two years ago means proving what was on the screen that day.

Make withdrawal as easy as giving it. If it took one click to consent and an email to a named person to withdraw, the arrangement will not survive scrutiny.

Children need more. Personal information of a child may generally only be processed with the consent of a competent person, meaning a parent or guardian, subject to limited exceptions. A business whose service is used by under-18s should treat that as a separate design question rather than an afterthought.

Special personal information is a different question

Everything above concerns ordinary personal information. Special personal information, which includes religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, and criminal behaviour, is prohibited from processing unless a specific authorisation applies.

For that category the analysis starts from prohibition rather than from a choice of grounds, and consent is one of the routes out. A business processing health information, biometric access control or criminal record checks should treat those as a separate exercise rather than folding them into the section 11 analysis.

Getting the ground wrong is not a technicality

It is tempting to treat the choice of ground as paperwork, on the basis that the processing either happens or it does not and the customer cannot tell which box you ticked.

Two things make that wrong. The first is that the ground determines the rights the data subject has. Consent carries a right to withdraw; legitimate interests carries a right to object; contractual necessity carries neither, because the processing is the contract. A business that told customers it was relying on consent has given them a right it may not be able to honour, and honouring it late is worse than never having offered it.

The second is that the Information Regulator's first question in any complaint is on what basis the processing took place. An answer that shifts, from consent when the customer objects to legitimate interests when consent is withdrawn, reads as an organisation that never decided. A single page recorded at the outset, listing each processing activity against its ground, is the difference between a short enquiry and a long one.

Worked example

This example is illustrative. A small hardware supplier has a customer database, sends invoices, keeps records for seven years, uses CCTV at the door, and emails a monthly specials list.

Under the consent-for-everything approach, the business sends every customer a consent form and treats non-responses as a compliance risk.

Under the Act as written, the analysis is: customer details for orders sit on contractual necessity; the seven-year retention sits on legal obligation; the CCTV sits on legitimate interests, subject to notices at the entrance and a sensible retention period; and only the monthly specials list needs to be examined against the direct marketing rules.

One of five activities required attention on consent. The other four were lawful already, and asking customers to consent to them created an obligation to stop processing if any of them said no, which the business could not have honoured for the tax records in any event.