Ask a small business whether it transfers personal information overseas and the answer is often immediate.
"No."
Then ask a few different questions.
Where is your email hosted?
Where does your payroll platform store employee information?
Where is your CRM hosted?
Can an overseas support team access your account?
Does your software provider use other providers to deliver the service?
Where are backups kept?
Suddenly the answer becomes less certain.
You do not need an international business strategy to create an international data flow.
If personal information is transferred from South Africa to a third party in another country, POPIA requires an appropriate section 72 route. The first practical job is therefore knowing whether the transfer exists at all.
Start with the actual supplier relationship in our POPIA Operators and Third Parties guide .
Where the international processing introduces privacy risk, connect it to the assessment approach in our PIIA guide .
If the transfer affects what data subjects should be told, review the transparency requirements in our Privacy Notices guide .
The vendor's address does not tell you where your data goes. Follow the information, not the brochure.
Understanding where your information really goes
Your data can travel further than your company does
A business does not usually buy a payroll system because it wants to make an international data transfer.
It buys payroll software because it wants to pay people.
It does not buy a CRM because it wants to create a section 72 question.
It wants to manage customers.
It does not adopt cloud storage because it wants an international privacy project.
It wants employees to work efficiently.
The cross-border element often arrives as a side effect of an ordinary business decision.
This is why asking only, "Where is the server?" can give a false sense of certainty.
The better question is:
Where can this information be received, accessed, supported, backed up or passed on?
POPIA does not simply ban overseas transfers
Section 72 starts with a restriction.
A responsible party in South Africa may not transfer personal information about a data subject to a third party in a foreign country unless one of the statutory routes in section 72 applies.
That is different from saying personal information must always stay in South Africa.
POPIA provides several routes through which an international transfer can take place.
So the practical task is not to search for a single universal "international transfer consent".
It is to identify which section 72 route actually fits the processing.
"Hosted in South Africa" may not answer the whole question
Local hosting can be an important fact.
It is not always the only fact.
Imagine a software provider tells you that your primary data is hosted in Johannesburg.
Good.
Then you discover that technical support is provided from another country, backups may be held elsewhere, and a third-party service provider supports part of the platform from overseas.
The data-centre answer was not wrong.
It was incomplete.
For an SMME, this does not mean interrogating every software provider with a 100-question questionnaire.
It means asking enough questions to understand the material processing.
Where is the information stored?
Who can access it?
From where?
Which other providers are involved?
Can the information move again after the initial transfer?
Those answers give you something useful to govern.
Adequate protection is more than the name of the country
Section 72 does not frame international transfers as a simple exercise of checking whether a country appears on an approved list.
Section 72(1)(a) looks at whether the foreign recipient is subject to a law, binding corporate rules or a binding agreement that provides the required adequate level of protection.
That protection must effectively uphold principles for reasonable processing that are substantially similar to POPIA's lawful-processing conditions.
It must also address further transfers in a substantially similar way.
That final point matters.
Your vendor may receive the information in one country and then involve another provider somewhere else.
POPIA does not stop asking questions at the first border.
POPIA also does not prescribe that South African businesses must use the European Union's Standard Contractual Clauses for every transfer.
An organisation using international contractual documentation should still assess whether the arrangement satisfies the requirements that apply under POPIA.
Consent is a route. It is not the only route.
There is a familiar privacy instinct when information is going overseas:
"Shouldn't we just get consent?"
Sometimes consent may be the appropriate section 72 basis.
But section 72 deliberately provides other routes.
That means the better compliance question is not:
"Where can we add a consent tick box?"
It is:
"Why is this transfer happening, and which section 72 provision actually supports it?"
That produces a more defensible decision and avoids building unnecessary consent dependencies into ordinary business processing.
Your privacy notice may need to know what your technology team knows
Cross-border governance is not only a supplier-contract issue.
It can also be a transparency issue.
Section 18(1)(g) requires the responsible party, where applicable, to make the data subject aware of the fact that it intends to transfer the information to a third country or international organisation and the level of protection afforded there.
That creates a simple operational problem.
The person drafting the privacy notice may not know that a new platform changed the international data flow.
IT knows where the system is hosted.
Procurement knows who the supplier is.
HR knows what employee information is being uploaded.
Compliance owns the privacy notice.
Each team knows one part of the story.
Nobody necessarily sees the whole thing.
See our section 18 Privacy Notices guide for the wider transparency requirements.
You do not need a world map on the boardroom wall
Cross-border compliance can sound like something designed for multinationals.
It does not need to be.
For an SMME, a useful cross-border record can be surprisingly simple.
POPIA does not prescribe a document called a "cross-border transfer register".
But keeping this information somewhere structured can turn a difficult legal question into an ordinary governance process.
A 30-person business replaces its HR spreadsheets
HR chooses a cloud platform to manage employee records, leave, performance information and supporting documents.
The provider tells the business that the platform is secure and compliant.
That is useful.
It is not yet the cross-border assessment.
None of this requires the SMME to become an international privacy-law expert.
It requires the business to know enough about the service it has purchased to make a defensible decision about the information it is handing over.
An incident is a bad time to discover where the data went
If a foreign supplier experiences a security compromise, the South African responsible party still needs enough visibility and contractual cooperation to understand what happened and manage its own POPIA responsibilities.
Our Security Compromises guide explains how the operator and responsible-party responsibilities interact when a compromise occurs.
Could you explain your international data flows tomorrow?
A useful SMME test is whether the business can answer these questions without starting a forensic search through supplier contracts.
Cross-border transfers under POPIA
Does POPIA require all personal information to stay in South Africa?
No. Section 72 permits transfers to third parties in foreign countries where one of the statutory routes in section 72(1) applies.
Do we always need consent for an international transfer?
No. Consent is one route under section 72(1)(b), but section 72 provides other routes, including adequate protection under section 72(1)(a) and specified contract-related circumstances.
Does using an overseas cloud provider automatically breach POPIA?
No. The relevant processing and transfer arrangement should be assessed against POPIA, including section 72 where personal information is transferred to a third party in a foreign country.
If the supplier says the data is hosted in South Africa, is that enough?
Local hosting is relevant, but the business should still understand whether foreign support access, other providers, backups or onward transfers create an international processing or transfer scenario that requires further assessment.
Does every cross-border transfer require prior authorisation from the Information Regulator?
No. Section 57(1)(d) creates a specific prior-authorisation trigger for transfers of special personal information or children's personal information to a third party in a foreign country that does not provide the adequate protection contemplated in section 72, subject to the qualifications in section 57.
Does POPIA prescribe a particular international transfer agreement?
Section 72(1)(a) refers to a law, binding corporate rules or binding agreement providing the required adequate level of protection. POPIA does not prescribe the EU Standard Contractual Clauses as the mandatory mechanism for every South African transfer.
Do we have to tell data subjects about foreign transfers?
Section 18(1)(g) requires, where applicable, that the responsible party take reasonably practicable steps to make the data subject aware of an intended transfer to a third country or international organisation and the level of protection afforded there, subject to the wider section 18 framework and exceptions.
Does POPIA require a document called a transfer impact assessment?
POPIA does not prescribe a document with that title as a general requirement for every section 72 transfer. An organisation may nevertheless use a documented transfer or privacy-risk assessment as a practical way to establish the facts, assess the statutory route and retain evidence of its decision.
The hardest transfer to govern is the one nobody knows exists
Cross-border compliance does not need to become an international legal project every time an SMME buys software.
But somebody needs to ask where the information goes.
That question should come before implementation, not after the first customer complaint or supplier incident.
Understand the flow.
Identify the recipient.
Establish the section 72 route.
Check whether higher-risk information triggers anything more.
Make sure the rest of the privacy programme tells the same story.
Your business may never open an overseas office. Your personal information may already have crossed the border.
Follow the data. Then govern the transfer.
The Provara Group POPIA Compliance Programme helps South African SMMEs connect data mapping, supplier governance, privacy risk, cross-border processing, privacy notices and evidence into one practical compliance framework.
This guide has been reviewed for alignment, as at 11 September 2026, with the Protection of Personal Information Act 4 of 2013, particularly sections 18, 57, 58 and 72.
Section 72(1) provides that a responsible party in the Republic may not transfer personal information about a data subject to a third party in a foreign country unless one of the statutory circumstances in section 72 applies.
Section 72(1)(a) permits a transfer where the foreign recipient is subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection. That protection must effectively uphold principles for reasonable processing that are substantially similar to POPIA's conditions for lawful processing and must contain provisions substantially similar to section 72 concerning further transfers to foreign third parties.
Section 72(1)(b) permits transfer with the data subject's consent. Sections 72(1)(c) and 72(1)(d) provide specified contract-related routes. Section 72(1)(e) provides a further route where the transfer benefits the data subject, it is not reasonably practicable to obtain consent and the data subject would be likely to consent if obtaining consent were reasonably practicable.
Section 72(2) defines binding corporate rules for purposes of the section as personal-information processing policies within a group of undertakings that are adhered to by a responsible party or operator in that group when transferring personal information to a responsible party or operator within the same group in a foreign country.
Section 57(1)(d) requires prior authorisation where a responsible party plans to transfer special personal information referred to in section 26, or the personal information of children referred to in section 34, to a third party in a foreign country that does not provide the adequate level of protection referred to in section 72. Section 57 contains further qualifications, including section 57(3), concerning processing governed by an applicable code of conduct that has come into force.
Section 58 governs notification and the prior-authorisation process where section 57 applies. A responsible party should therefore identify a section 57 trigger before commencing the affected processing rather than treating prior authorisation as a retrospective filing.
Section 18(1)(g) requires a responsible party collecting personal information, where applicable, to take reasonably practicable steps to make the data subject aware of the fact that it intends to transfer the information to a third country or international organisation and of the level of protection afforded to the information there. The requirement operates within the wider section 18 notification framework, including its timing rules and statutory exceptions.
POPIA does not prescribe a document called a cross-border transfer register or transfer impact assessment as a general statutory document for every transfer. References in this guide to transfer mapping, location records, transfer assessments and review triggers are practical governance mechanisms intended to help organisations establish the facts, apply sections 57 and 72 where relevant, and retain appropriate evidence of their decisions.
References to foreign access, support, hosting, backups and onward service providers should not be read as stating that every such arrangement automatically constitutes a section 72 transfer. The actual processing and recipient relationship should be established and assessed on its facts.
Cross-border processing may also engage other POPIA requirements, including accountability, purpose limitation, openness, security safeguards, operator governance and the processing rules applicable to special personal information or children's information. Sector-specific legislation or an applicable code of conduct may create additional requirements.
Important: This article provides general compliance information and practical governance guidance. It is not legal advice, does not constitute a legal opinion and does not guarantee compliance. International-processing arrangements should be assessed against the actual data flows, recipients, countries, contractual arrangements, information categories, purposes, applicable laws and operating circumstances.