Cross-Border Transfer of Personal Information
Also known as: International Data Transfer, Offshore Data Transfer.
What is Cross-Border Transfer of Personal Information?
Cross-border transfer is the movement of personal information outside South Africa to a third country or international organisation. Section 72 of POPIA prohibits such transfer unless one of five lawful bases applies — adequate foreign law, binding agreement, data-subject consent, performance of a contract, or benefit to the data subject. It is the cornerstone of international data flows compliance.
Drafted and reviewed by
Attorney & Founder, My-Contracts.co.za · Legal Practice Council of South Africa (LPC F17333)
Definition and context
Section 72 of the Protection of Personal Information Act 4 of 2013 prohibits a responsible party from transferring personal information about a data subject to a third party who is in a foreign country, unless one of five grounds applies: (a) the recipient is subject to a law, binding corporate rules or agreement which provides an adequate level of protection that effectively upholds the POPIA conditions and includes sub-transfer controls; (b) the data subject consents; (c) the transfer is necessary for performance of a contract between the data subject and the responsible party; (d) the transfer is necessary for pre-contractual measures at the data subject\'s request; or (e) the transfer benefits the data subject and consent is not reasonably practicable.
The Information Regulator has not published a formal adequacy list, but jurisdictions with comprehensive data-protection laws (EU/EEA under GDPR, United Kingdom, Mauritius, Ghana, Kenya, Nigeria, Uganda) are widely treated as offering adequate protection. For transfers to the United States, India or China, the common route is ground (a) read with contractual safeguards — a binding operator agreement incorporating Standard Contractual Clauses–style commitments, or intra-group binding corporate rules. The Information Regulator\'s Guidance Note on Cross-Border Transfers (not yet published in final form at the time of writing) is expected to mirror the GDPR\'s approach following Schrems II.
In practice, attorneys drafting cloud agreements and outsourced services contracts should (i) map the data flows, (ii) identify the third-country recipients and any onward transfers, (iii) nominate a lawful basis under section 72 and document it in the operator agreement, and (iv) build transfer impact assessments (TIAs) into the data protection policy. Failure to comply with section 72 is an interference with protection of personal information under section 73 and triggers the section 109 administrative fine regime.
Where this term lives in law
Protection of Personal Information Act 4 of 2013
Sections: 1, 8, 19, 21, 72, 73, 109
Regulates the processing of personal information by public and private bodies in South Africa.
Frequently asked questions
When can personal information be transferred outside South Africa?
Only on one of the five section 72 grounds: adequate foreign law or binding agreement; data-subject consent; performance of a contract with the data subject; pre-contractual measures at the data subject's request; or benefit of the data subject where consent is not reasonably practicable.
Does POPIA have an adequacy list like the GDPR?
Not yet. The Information Regulator has not issued a formal adequacy list. In practice the GDPR EEA jurisdictions, the UK, and other comprehensively regulated African jurisdictions are treated as adequate. For the US, China, India and similar, contractual safeguards under section 72(1)(a) are used.
What contractual safeguards satisfy section 72(1)(a)?
An agreement that contractually replicates the eight POPIA conditions and includes onward transfer controls — typically an operator agreement incorporating Standard Contractual Clauses–style obligations, or binding corporate rules for intra-group transfers, aligned to the Information Regulator's pending guidance.
Is using AWS or Azure a cross-border transfer?
Generally yes, because hyperscaler cloud providers store and support data from foreign regions. Even if the primary region is in South Africa, support access from abroad engages section 72. Use the AWS or Azure Data Processing Addendum, confirm the region, and document the section 72 basis in the operator agreement.
Contract templates using this term
5 templates reference Cross-Border Transfer of Personal Information.