Regulations relating to the processing of data subjects’ health information by certain parties

The Regulations are published under the Protection of Personal Information Act 4 of 2013 (the Act) and focus on the processing, security, and transfer of health information by responsible parties. The purpose of these Regulations is to assist with the interpretation of section 32(6) of the Act, enhance transparency, and provide a framework for the information regulator on enforcement mechanism for the processing of health information of data subjects as provided in section 32(6) of the Act.

9 Mar 2026 1 min read Employment Law Alert Article

At a glance

On 6 March 2026, the Chairperson of the Information Regulator published Regulations under section 112(2)(c) of the Protection of Personal Information Act.
The Regulations relate to the processing of data subjects' health information by certain responsible parties.
Chapters 1 to 4 are covered by the Regulations, dealing with the definitions, scope, purpose, processing of personal information by certain responsible parties, appropriate safeguards, transfer of personal information and commencement.

Responsible party

A responsible party includes insurance companies, medical schemes, medical scheme administrators, pension funds, administrative bodies, employers, managed healthcare organisations, and institutions working for employers.

Processing of data subject’s health information

Processing of health information is permitted only under specific legal authorisations. A responsible person may, subject to section 27 of the Act, not process personal information concerning the religious beliefs, race or ethnic origin, trade union membership, health or sex life, or biometric information of a data subject.

Safeguards

Responsible parties must implement appropriate technical and organisational measures to ensure confidentiality, integrity, and the restricted availability of information in their possession or under their control. These measures are aimed at preventing loss or damage to or unauthorised destruction of health information, as well as unlawful access to or processing of health information.

Safeguards include measures to secure record management and the proper disposal of that information to prevent unauthorised access or unlawful disclosure.

Transfer of personal information

The Regulations prohibit the transfer of health information of a data subject to a third party in a foreign country unless one or more of the requirements set out in section 72(1) of the Act are met.

Commencement

The Regulations commenced on date of publication, 6 March 2026.

The information and material published on this website is provided for general purposes only and does not constitute legal advice. We make every effort to ensure that the content is updated regularly and to offer the most current and accurate information. Please consult one of our lawyers on any specific legal problem or matter. We accept no responsibility for any loss or damage, whether direct or consequential, which may arise from reliance on the information contained in these pages. Please refer to our full terms and conditions. Copyright © 2026 Cliffe Dekker Hofmeyr. All rights reserved. For permission to reproduce an article or publication, please contact us cliffedekkerhofmeyr@cdhlegal.com.