Sharing personal information

POPIA and debt collection: handing over debtors is lawful

Contract, legal obligation and legitimate interest all support handing over a debtor; recovery proceedings are deemed-compatible further processing.

Published Last reviewed 6 min read

Written by

Martin Kotze

Attorney, Conveyancer & Notary Public

Quick answer
POPIA does not block debt collection. The credit agreement (s 11(1)(b)), statutory collection frameworks (s 11(1)(c)) and your legitimate interest in recovering what you are owed (s 11(1)(f)) all support handing a debtor over to collectors or attorneys; recovery proceedings are deemed-compatible further processing (s 15(3)(c)(iii)); and the debtor’s consent is not required — which is fortunate, because no debtor would give it.

Which grounds carry debt collection?

Three of the six lawful grounds converge on collection. The credit agreement itself: processing necessary for the performance of a contract (s 11(1)(b)). Statutory frameworks — the National Credit Act, the Debt Collectors Act — impose and authorise processing (s 11(1)(c)). And recovering what you are owed is the paradigm case of a legitimate interest (s 11(1)(f)), one the courts and the Regulator have never doubted. The myth that POPIA blocks debt collection has no statutory basis.

Why handing over the file is deemed compatible

You collected the debtor’s information to run the account, not to litigate — does passing it to attorneys break the purpose limitation? No. Section 15(3) deems further processing compatible where it is:

Source — the actual words

“necessary... for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated”

Protection of Personal Information Act 4 of 2013, s 15(3)(c)(iii)Read it on Dept of JusticePDF

Handing a defaulting debtor’s file to your attorney or collection agent ahead of contemplated proceedings is textbook deemed-compatible further processing — the three checks pass without the debtor’s say-so.

Tracing the debtor who disappeared

Direct collection from the data subject (s 12(1)) obviously fails when the data subject has vanished. The exceptions in section 12(2) were written for exactly this: collection from another source is permitted where it is necessary to maintain your legitimate interests, where the information is in a public record, or where proceedings are reasonably contemplated. A tracing agent searching deeds records, CIPC filings and contact databases to locate a defaulter operates inside those exceptions — see minimality and collection.

What still disciplines collection

Lawful ground does not mean lawless conduct. Minimality limits the file to what recovery needs. Information quality matters acutely — collecting the wrong person’s “debt” is both a POPIA quality failure and a defamation risk. Your collectors and tracing agents are operators needing written contracts. And the conduct rules of the National Credit Act and Debt Collectors Act run alongside POPIA — the Act removed none of them.

Frequently asked questions

Do I need a debtor’s consent to hand them to a collection agency?

No. The handover rests on the contract, statutory collection frameworks and your legitimate interest in recovery — and recovery proceedings are deemed-compatible further processing under section 15(3)(c)(iii).

May my attorney receive the whole debtor file?

The attorney may receive what the recovery reasonably needs — the agreement, statements, payment history and contact details. Minimality still applies: the debtor’s unrelated records stay home.

Can I list a defaulter with a credit bureau?

Credit reporting runs within the National Credit Act’s framework — a legal-obligation and legitimate-interest context POPIA accommodates. Note that processing "for the purposes of credit reporting" as a business is one of the narrow section 57 prior-authorisation triggers.

Is using a tracing agent lawful?

Yes. Collection from sources other than the data subject is excepted where it maintains your legitimate interests or is necessary for contemplated court proceedings (s 12(2)) — tracing a debtor fits both.

Sources

See the full POPIA source library for every Act, regulation, guidance note and enforcement document cited across this hub.

Why you can trust this: Martin Kotze has been an admitted Attorney of the High Court of South Africa, registered Conveyancer, and Notary Public since 2014, practising from Pretoria. The firm is regulated by the Legal Practice Council under firm registration F17333.

This guide is general information, not legal advice for your specific matter.

Work with an attorney

Get POPIA right for your business

Martin Kotze advises on privacy and data protection — grounds mapping, privacy notices, operator agreements, marketing compliance and breach response. General guidance on this page is not a substitute for advice on your facts.