# POPIA Section 11: The Six Lawful Bases for Personal Data Processing
Every time your organisation processes personal data—whether you're collecting customer contact details, storing employee records, or maintaining a supplier database—you need a lawful basis to do so. In South Africa, that requirement comes from POPIA section 11, which sets out six distinct grounds on which processing is permitted.
Understanding these bases is foundational work for any Information Officer or compliance team mapping processing activities. This post walks through each one, with practical examples.
Why lawful basis matters
POPIA's principle of lawfulness (section 5) requires that personal information must be processed lawfully, fairly, and in a transparent manner. Section 11 operationalises this by listing the only circumstances under which processing is allowed. If your processing doesn't fall into at least one of these bases, it breaches POPIA—and you expose your organisation to enforcement action by the Information Regulator.
See the Information Regulator's guidance on processing conditions for the official position.
The six lawful bases (POPIA section 11)
1. Consent
Section 11(1)(a): The data subject has consented to the processing.
Consent is the most familiar basis. It means the individual has given clear, voluntary, informed permission.
Practical notes: - Consent must be *specific* (you cannot use a blanket "agree to everything" tick-box) and *informed* (the person understands what they are consenting to). - It must be *freely given*—so bundling consent with an essential service ("consent or you cannot buy from us") may not be freely given unless processing is truly necessary for that service. - You must be able to prove consent was given. Keep records. - The data subject can withdraw consent at any time (section 11(3)).
Example: A retail business collects a customer's email address and the customer ticks a box saying, "Yes, send me promotional emails about new products." That's consent. If the customer later clicks "Unsubscribe," consent is withdrawn.
2. Contractual necessity
Section 11(1)(b): Processing is necessary to carry out actions at the request of the data subject, or to enter into or perform a contract to which the data subject is a party.
You can process data because the data subject has asked you to, or because you need that data to perform a contract with them.
Practical notes: - The processing must actually be *necessary*—not merely convenient. - Once the contract ends, you should stop processing, unless another lawful basis applies (e.g., a legal obligation to retain records). - This basis is not available for optional extras; it covers what is genuinely required to deliver the service.
Example: A client signs a service agreement with you. To fulfil it, you need their bank details to process payment and their address to deliver the service. Processing for those purposes is necessary to the contract.
3. Legal obligation
Section 11(1)(c): Processing is necessary to comply with an obligation imposed by law.
If the law requires you to keep records, file reports, or disclose data, you can process on this basis without consent.
Practical notes: - The legal obligation must be in force (not merely proposed). - Cite the specific statute or regulation (e.g., "section 28 of the Income Tax Act"). - This basis justifies *only* the processing required by that law, not extra processing.
Example: SARS requires businesses to keep payroll and tax records for a set period. Processing employee data for tax compliance is lawful under this basis. See SARS guidance on record retention.
4. Vital interests
Section 11(1)(d): Processing is necessary to protect the vital interests of the data subject or another person.
This is a narrow, emergency basis. It applies when processing is essential to protect someone's life, health, or safety.
Practical notes: - "Vital interests" means physical or mental well-being in an acute sense. - This basis is not about convenience or business interests; it is genuinely about preventing serious harm. - Use this basis only when no other basis is available.
Example: A healthcare provider has a patient in a coma and no emergency contact on file. The provider calls the patient's employer (whose contact details are in an old form) to locate a family member. That emergency disclosure is justified under vital interests.
5. Public task or statutory function
Section 11(1)(e): Processing is necessary for the performance of a public task or statutory function.
Government agencies, municipalities, and organisations exercising public authority can process data as necessary to carry out their statutory duties.
Practical notes: - The function must be set out in law. - The processing must be necessary to that function, not incidental. - This basis is primarily for public bodies, though some private organisations may carry statutory functions (e.g., a blood bank operating under health regulations).
Example: A municipality processes ratepayer details to assess and levy property tax under its statutory powers.
6. Legitimate interests
Section 11(1)(f): Processing is necessary for the purposes of the legitimate interests pursued by the responsible party or a third party, provided that processing does not outweigh the rights or interests of the data subject.
This is the broadest and often most contested basis. It allows processing for business, organisational, or other legitimate purposes—*provided* the data subject's privacy is not unduly harmed.
Practical notes: - You must first identify your legitimate interest (e.g., "fraud prevention," "business analytics," "security"). - Then assess whether processing is *necessary* to achieve it. Is there a less invasive way? - Finally, balance: does your interest outweigh the data subject's privacy? Consider the data subject's reasonable expectations, the sensitivity of the data, and whether they can opt out. - Document this balancing test. The Information Regulator expects to see it.
Example: A bank processes customer transaction data to detect fraudulent activity. Its legitimate interest is preventing fraud and protecting customer funds. The necessity is clear (you need transaction data to spot anomalies). The balance likely favors processing, because customers expect fraud checks and the bank minimises visibility of raw data through automated systems. However, if the bank sold that data to third-party marketers without strong privacy safeguards, that secondary processing would likely *not* pass the balancing test.
How to map your bases
When you audit your processing, for each activity:
- List the data being processed and the purpose(s).
- Identify the basis (or bases—multiple can apply).
- Document your reasoning, especially for consent and legitimate interest.
- Verify compliance with the specific rules for that basis (e.g., if consent, do you have proof? If legal obligation, which law?).
- Review regularly, because circumstances change. A basis that was valid may no longer apply, or a new basis may become necessary.
Common pitfalls
- Confusing "consent" with "legitimate interest". Consent is active permission; legitimate interest is a business justification. They are different tests.
- Assuming consent covers everything. Even with consent, you must still minimise data collection and respect data subject rights (access, deletion, etc.).
- Forgetting to document. If you cannot show your lawful basis when asked by the Regulator, you are in breach.
- Bundling unrelated purposes under one basis. If you collect email "for order updates" but actually use it for marketing, consent for marketing is required separately.
Next steps
For detailed guidance, consult the Information Regulator's published materials on processing conditions. If you are mapping a large dataset or uncertain about a particular purpose, consider engaging a data protection officer or legal counsel qualified in POPIA.
---
Disclaimer: This post is guidance based on a reading of POPIA and published regulator materials. It is not legal advice. For specific compliance questions or disputes, consult a qualified attorney practising in data protection law.