Each company stands alone
Corporate groups feel like one business, but POPIA sees juristic persons — and each is “a public or private body or any other person which... determines the purpose of and means for processing” in its own right. Information moving from OpCo to HoldCo is therefore a disclosure to a third party, and the three checks apply exactly as they would for an outsider: ground, compatibility, conditions. What the group relationship changes is how easily those checks pass — not whether they apply.
The grounds that carry group flows
Legitimate interests does most of the work: consolidated reporting, group risk and fraud management, shared compliance functions, centralised HR and IT. Contract carries flows the customer’s own agreement contemplates (the group entity that actually delivers part of the service). Legal obligation carries statutory group reporting. The balancing leg is helped by transparency — group sharing your privacy notice discloses sits within reasonable expectations; group sharing nobody mentioned does not.
Cross-border: binding corporate rules
Where the group crosses borders, section 72 adds its gate — and was written with groups in mind. The first gateway covers a recipient subject to “binding corporate rules” providing substantially similar protection, defined as:
“’binding corporate rules’ means personal information processing policies, within a group of undertakings, which are adhered to by a responsible party or operator within that group of undertakings when transferring personal information to a responsible party or operator within that same group of undertakings in a foreign country”
One well-drafted group data-protection policy, genuinely adhered to, covers the recurring offshore flows — no per-transfer consent needed. The wider transfer rules are on the cross-border page.
Group housekeeping
Three items keep group sharing defensible. Document the architecture — which entity is responsible party for which processing, and where one entity serves the others as an operator, put the section 21 contract in place. Tell people — every notice in the group should disclose intra-group flows. Register every information officer — the Regulator’s Guidance Note requires each subsidiary to register its own (see information officers).