CATEGORIES
- (40)Agriculture, Land Reform & Rural Development
- (30)Auditors & Accountants
- (10)Broad-based Black Economic Empowerment
- (7)Built Environment
- (79)Communications & Digital Technologies
- (2)Company Law
- (2)Consumer Law
- (34)Courts
- (4)Criminal Law
- (1)Cybercrimes
- (2)Disaster Management
- (17)Education & Training
- (8)Electoral Law
- (127)Environmental Law
- (4)Family Law
- (180)Financial Sector
- (5)Fisheries & Aquaculture
- (10)General Interest
- (28)Health & Safety
- (25)Home Affairs
- (3)Housing
- (30)In the Spotlight
- (1)International Co-operation
- (86)Justice & Constitutional Development
- (72)Labour Law
- (21)Legal Practice Council
- (24)Local & Provincial Government
- (34)Minerals & Energy
- (1)Monetary Policy
- (2)National Development Plan
- (34)National Treasury
- (92)New Legislation
- (28)Opportunities for Public Comment
- (9)POPIA
- (364)Parliament
- (1)Practice Management
- (7)Presidency
- (19)Property Law
- (9)Public Service
- (4)Retirement Reform
- (18)Road Accident Fund
- (30)Safety and Security
- (13)Small Business Development
- (28)Social Development
- (13)Sport, Arts & Culture
- (15)State Owned Enterprises
- (4)State of Disaster (energy)
- (25)Taxation
- (8)Tourism
- (100)Trade, Industry & Competition
- (46)Transport
- (21)Water & Sanitation
- Show All
POPIA: DATA SUBJECT HEALTH INFORMATION REGULATIONS GAZETTED, IN FORCE
- 06 March 2026
- POPIA
- SA Legal Academy
The Information Regulator has gazetted regulations under the 2013 Protection of Personal Information Act intended to ‘assist responsible parties to interpret section 32(6) of the Act correctly’. Released in September 2025 in draft form for public comment, the new regulations are immediately effective.
This is noting that the Act’s sub-section 32(6) empowers the Regulator to prescribe ‘more detailed rules’ regarding the application of sub-section 32(1) (b) and (f). Together those sub-sections exempt:
- insurance companies, medical schemes, medical scheme administrators and managed healthcare organisations from the Act’s ‘prohibition on processing personal information concerning a data subject’s health or sex life’ … if such processing is necessary’ for:
- ‘assessing the risk to be insured by the insurance company or covered by the medical scheme, and the data subject has not objected to the processing’
- the performance of an insurance or medical scheme agreement, or
- the enforcement of any contractual rights and obligations, as well as
- administrative bodies, pension funds, employers or institutions working for them, if such processing is necessary for
- ‘the implementation of the provisions of laws, pension regulations or collective agreements which ‘create rights dependent on the health or sex life of the data subject’, or
- ‘the reintegration of or support for workers or persons entitled to benefit in connection with sickness or work incapacity’.
In addition, the new regulations provide:
- ‘better transparency to data subjects on the manner in which their health information may be used’, and
- ‘a framework to the ... Regulator regarding the enforcement mechanism for the processing of health information of data subjects’.
Please click the links below for more information:
- regulations
- Act, updated (SAFLII)
Published by SA Legal Academy Policy Watch
Follow us on X @SALegalAcademy (you can also join us on LinkedIn and Facebook)
If you use this information in articles, reports and social media posts of your own, please acknowledge SA Legal Academy Policy Watch as your source