An employee joins the business and is added to payroll.
A customer places an order. A supplier contact is added to an accounts system. A business keeps records because legislation requires it to do so.
All of these activities can involve personal information.
But that does not mean the first compliance step is:
“Get consent.”
POPIA requires a more precise assessment of why the information is being processed and which section 11 justification supports that processing.
Understand what you are doing and why. Then identify the section 11 justification that genuinely supports the processing.
Your processing inventory or ROPA identifies what the organisation is processing and why.
Your PIIA and privacy-risk process helps assess risks arising from the processing and whether controls are adequate.
Your data-subject rights process should also reflect the objection and consent-withdrawal rights that may apply to the processing.
Consent is not a universal compliance shortcut. The correct justification depends on the processing activity and its purpose.
Choosing and documenting a POPIA processing justification
Lawful processing starts before section 11
Section 11 is central to lawful processing, but it does not operate in isolation.
Section 9 requires personal information to be processed lawfully and in a reasonable manner that does not infringe the privacy of the data subject.
Section 10 adds the minimality requirement: personal information may only be processed if, given the purpose, it is adequate, relevant and not excessive.
Section 13 then requires personal information to be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party.
POPIA provides six grounds for processing
Section 11 is headed “Consent, justification and objection.”
It provides six circumstances in which personal information may be processed.
When does consent apply?
Consent is a valid section 11 justification.
POPIA defines consent as a voluntary, specific and informed expression of will through which permission is given for the processing of personal information.
Where an organisation relies on consent under section 11(1)(a), section 11(2)(a) places the burden of proving that consent on the responsible party.
Consent can be withdrawn
Section 11(2)(b) permits the data subject or competent person to withdraw consent referred to in section 11(1)(a) at any time.
Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.
Section 11(2)(b) also expressly provides that processing under section 11(1)(b) to (f) is not affected by the withdrawal of consent.
Contract and legal obligation are different grounds
Section 11(1)(b): contract
Processing may be justified where it is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is a party.
Two parts of that wording matter.
The Information Regulator has emphasised in enforcement that the necessity question requires a fact-based assessment of whether the processing is necessary for the contractual objective being pursued.
Section 11(1)(c): obligation imposed by law
Section 11(1)(c) applies where the processing complies with an obligation imposed by law on the responsible party.
The organisation should be able to identify the legal obligation relied upon and explain how the processing relates to that obligation.
“Legitimate interests” needs careful analysis
The phrase “legitimate interests” appears in more than one section 11 ground, but the grounds are not identical.
Section 11(1)(f) is not a catch-all
The Information Regulator's enforcement approach has distinguished the purpose of the processing from the legitimate interest being pursued.
In other words, “we need the information for business purposes” is not, by itself, a complete legitimate-interest analysis.
The organisation should identify the interest being pursued, assess why the processing is necessary for that interest and consider the effect of the processing on the data subject.
The justification affects the data subject's rights
Consent withdrawal and objection are different rights.
Where processing relies on consent under section 11(1)(a), section 11(2)(b) allows that consent to be withdrawn at any time.
Section 11(3)(a) separately allows a data subject to object, in the prescribed manner, to processing under section 11(1)(d), (e) or (f) on reasonable grounds relating to his, her or its particular situation, unless legislation provides for that processing.
Section 11(3)(b) also provides an objection right for direct marketing other than direct marketing by unsolicited electronic communication as referred to in section 69.
Where an objection is made in terms of section 11(3), section 11(4) provides that the responsible party may no longer process the personal information.
Section 11 is not the whole compliance test
A common mistake is to identify a section 11 justification and conclude that the processing is automatically compliant.
POPIA contains additional requirements that may apply depending on the information and processing involved.
Document the justification where the processing is recorded
POPIA does not prescribe a document called a lawful-basis register.
It also does not prescribe a document called a ROPA or prescribe particular columns for one.
As a practical governance measure, the processing record is the logical place to connect the activity, purpose and section 11 justification.
A customer places an online order
The customer gives the business a name, delivery address, contact information and information required to process the order.
The business should not automatically conclude that consent is the justification simply because the customer supplied personal information.
Different processing purposes should be analysed separately.
Can your business explain why it processes personal information?
Lawful processing under POPIA: practical questions
Does POPIA require consent for all processing?
No. Consent is one of six grounds in section 11(1). Processing may also be justified under sections 11(1)(b) to (f) where the relevant statutory requirements are satisfied.
Can we rely on a contract whenever we have one?
No. Section 11(1)(b) applies where processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is a party. The necessity of the processing must therefore be assessed.
What if another law requires the processing?
Section 11(1)(c) permits processing where it complies with an obligation imposed by law on the responsible party. The organisation should identify the actual legal obligation relied upon.
Can consent be withdrawn?
Yes. Section 11(2)(b) provides that consent relied upon under section 11(1)(a) may be withdrawn at any time. Processing before withdrawal is not retrospectively made unlawful, and processing under section 11(1)(b) to (f) is not affected by the withdrawal.
Can legitimate interests be used for everything that is useful to the business?
No. Section 11(1)(f) requires the processing to be necessary for pursuing the legitimate interests of the responsible party or a third party to whom the information is supplied. The interest and necessity of the processing should be properly assessed.
Does POPIA require a legitimate-interest assessment document?
POPIA does not prescribe a document with that title as a general section 11 requirement. A documented assessment is a practical governance mechanism for recording why section 11(1)(f) is considered applicable.
Can a data subject object to processing based on legitimate interests?
Section 11(3)(a) allows objection to processing under section 11(1)(d) to (f), in the prescribed manner and on reasonable grounds relating to the data subject's particular situation, unless legislation provides for that processing.
Is section 11 enough for electronic direct marketing?
No. Section 69 contains specific requirements for direct marketing by unsolicited electronic communications and must be considered in addition to the wider POPIA framework.
Does a section 11 ground automatically permit special personal information or children's information?
No. POPIA contains additional rules for special personal information in sections 26 to 33 and personal information of children in sections 34 and 35. Those requirements must also be considered where applicable.
Does POPIA prescribe a lawful-basis register?
No. POPIA does not prescribe a document with that title. Recording the section 11 justification in the organisation's processing inventory is a practical governance mechanism for maintaining and evidencing the lawful-processing assessment.
The goal is not to find a legal label. It is to understand the processing.
An SMME does not need a legal memorandum for every routine processing activity.
It does need enough discipline to understand what information is being processed, why it is being processed and which section 11 justification genuinely applies.
That decision should then connect to the organisation's processing records, privacy notices, controls and data-subject rights.
Start with the processing. Understand the purpose. Then identify the justification that actually fits.
Know what you process. Know why you are permitted to process it.
The Provara Group POPIA Compliance Programme gives South African SMMEs a structured implementation pathway for processing inventories, lawful-processing assessment, privacy risk, notices, operator governance, data-subject rights, evidence and ongoing compliance management.
This guide has been reviewed for alignment, as at 7 September 2026, with the Protection of Personal Information Act 4 of 2013, particularly sections 8 to 13 concerning accountability, lawfulness, minimality, consent, justification, objection, collection and purpose specification; sections 26 to 35 concerning special personal information and personal information of children; section 57 concerning processing subject to prior authorisation; section 69 concerning direct marketing by means of unsolicited electronic communications; and section 72 concerning transfers of personal information outside the Republic.
Section 9 requires personal information to be processed lawfully and in a reasonable manner that does not infringe the privacy of the data subject. Section 10 provides that personal information may only be processed if, given the purpose, it is adequate, relevant and not excessive.
Section 11(1) provides six circumstances in which personal information may be processed: consent under section 11(1)(a); processing necessary for the conclusion or performance of a contract to which the data subject is party under section 11(1)(b); processing that complies with an obligation imposed by law on the responsible party under section 11(1)(c); processing that protects a legitimate interest of the data subject under section 11(1)(d); processing necessary for the proper performance of a public-law duty by a public body under section 11(1)(e); and processing necessary for pursuing the legitimate interests of the responsible party or a third party to whom the information is supplied under section 11(1)(f).
POPIA defines consent in section 1 as a voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information. Section 11(2)(a) places the burden of proof for consent relied upon under section 11(1)(a) on the responsible party.
Section 11(2)(b) permits withdrawal of consent referred to in section 11(1)(a) at any time. It provides that withdrawal does not affect the lawfulness of processing before withdrawal or processing under section 11(1)(b) to (f).
Section 11(3)(a) permits a data subject to object, in the prescribed manner and on reasonable grounds relating to his, her or its particular situation, to processing under section 11(1)(d) to (f), unless legislation provides for the processing. Section 11(3)(b) separately provides an objection right for direct marketing other than direct marketing by unsolicited electronic communications referred to in section 69. Section 11(4) provides that where a data subject has objected to processing in terms of subsection (3), the responsible party may no longer process the personal information.
Regulation 2 of the Regulations relating to the Protection of Personal Information, as amended with immediate effect from 17 April 2025, governs the current process for objections under section 11(3). It provides for objections free of charge using a form substantially similar to Form 1 and through the accessible methods specified in that Regulation, and requires telephonic objections to be electronically recorded.
Section 13 requires personal information to be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party. A section 11 justification should therefore be assessed in the context of the particular processing purpose rather than selected in isolation.
The Information Regulator's enforcement notice issued in relation to the Department of Basic Education on 6 November 2024 illustrates the Regulator's application of section 11. Among other things, the Regulator stated that necessity under section 11(1)(b) requires a fact-based assessment and distinguished the purpose of processing from the legitimate interest relied upon for purposes of section 11(1)(f). This guide refers to that enforcement approach as regulatory interpretation and does not present the particular facts of that matter as a universal statutory test for every organisation.
Section 26 creates a general prohibition on processing special personal information, subject to the general and category-specific authorisations in sections 27 to 33. Section 34 creates a general prohibition on processing personal information concerning children, subject to section 35. A section 11 ground should therefore not be treated as replacing those additional requirements.
Section 57 identifies specified categories of processing that require prior authorisation from the Information Regulator, subject to the provisions and qualifications in that section and section 58. Section 69 contains the specific regime for direct marketing by unsolicited electronic communications. Section 72 contains requirements applicable to transfers of personal information to a third party in a foreign country.
References in this guide to a ROPA, processing inventory, lawful-processing assessment, legitimate-interest assessment, lawful-basis register, processing-owner field, review trigger or supporting decision record describe practical governance approaches. They are not presented as statutory POPIA document names or prescribed formats unless expressly identified as such.
Depending on the processing activity, additional requirements may arise from other legislation, regulations, applicable codes of conduct, employment law, consumer law, contractual requirements or sector-specific regulation.
Important: This article provides general compliance information and practical governance guidance. It is not legal advice, does not constitute a legal opinion and does not guarantee compliance. The appropriate processing justification depends on the specific processing activity, purpose, information, data subjects, legal environment and circumstances of the responsible party.