The statutory framework
Two provisions do the work. The ground: section 11(1)(c) — processing that “complies with an obligation imposed by law on the responsible party”. And compatibility — section 15(3)(c) deems further processing compatible where it is necessary:
“to avoid prejudice to the maintenance of the law by any public body including the prevention, detection, investigation, prosecution and punishment of offences ... to comply with an obligation imposed by law or to enforce legislation concerning the collection of revenue as defined in section 1 of the South African Revenue Service Act, 1997”
Together they mean a lawful demand from SAPS, SARS, the FIC, a professional regulator or a court does not put you in breach of POPIA — refusing it is what creates legal jeopardy.
How to vet a request before disclosing
Four steps, every time. Basis — ask which statutory power or court process underlies the request; a genuine official request always has one (a warrant, a s 46 TAA notice, a subpoena). Scope — read what it actually covers; disclose that, not your whole file (minimality survives even legal obligation). Verify — confirm the requester is who they claim to be, through official channels, before sending anything. Record — log the request, the basis, what you disclosed and when. The record is what proves accountability (s 8) if the disclosure is ever challenged from either direction.
Informal requests and tip-offs
An investigator’s phone call asking you to “just send the customer’s details” carries no section 11(1)(c) obligation — there is no obligation without a legal power exercised in proper form. That does not always make disclosure unlawful: volunteering information to prevent or investigate crime can rest on legitimate interests and the law-enforcement compatibility ground, judged on the seriousness and urgency. But it is a choice you must be able to justify, not a demand you must obey — and the SAPS Krugersdorp matter shows the Regulator polices over-sharing in the name of policing (see when POPIA applies).
Litigation and discovery
Court process is expressly accommodated at both ends of the information lifecycle: collection from other sources is excepted where necessary for “the conduct of proceedings in any court or tribunal” (s 12(2)(d)(iii)), and further processing for commenced or reasonably contemplated proceedings is deemed compatible (s 15(3)(c)(iii)). Discovery, subpoenas duces tecum, and briefing counsel all proceed without data-subject consent — POPIA was never intended to be a litigation shield. See also debt collection, the everyday version of the same rules.