What does section 11 actually say?
This is the provision that kills the master myth — the belief that POPIA requires consent for everything. Here is section 11(1) in full. Six grounds, separated by “or”. Any one of them makes the processing lawful:
“(1) Personal information may only be processed if— (a) the data subject or a competent person where the data subject is a child consents to the processing; (b) processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party; (c) processing complies with an obligation imposed by law on the responsible party; (d) processing protects a legitimate interest of the data subject; (e) processing is necessary for the proper performance of a public law duty by a public body; or (f) processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.”
The Act creates no hierarchy and expresses no preference for consent. If your processing is necessary for a contract, you do not also need consent. If a law obliges you to process, you do not also need consent. Collecting consent you don’t need is not harmless belt-and-braces either — it makes your processing revocable at will (see why consent is often the worst choice).
The six grounds in plain terms
Consent
s 11(1)(a)The data subject agrees — voluntarily, specifically and informedly. Use it when nothing else fits.
Examples: Newsletters, profiling, marketing to people who aren’t customers, optional extras.
Contract
s 11(1)(b)You need the information to conclude or perform a contract with the person. The contract is the ground — no consent form needed.
Examples: The gym’s debit-order details; the attorney’s FICA file; the online shop’s delivery address.
Legal obligation
s 11(1)(c)A law requires the processing. You not only may process this information — you must.
Examples: Payroll information to SARS; FICA verification; employment records under the BCEA; COIDA returns.
The data subject’s own interest
s 11(1)(d)Processing that protects the person themselves.
Examples: Passing a collapsed visitor’s details to paramedics; fraud alerts to a customer.
Public law duty
s 11(1)(e)Public bodies performing their statutory functions.
Examples: A municipality billing for services; a regulator processing licence applications.
Legitimate interests
s 11(1)(f)The workhorse: processing necessary to pursue your legitimate interests or those of the third party receiving the information — balanced against the data subject’s.
Examples: Fraud prevention, security and CCTV, debt recovery, internal administration, IT security, employee references.
Grounds (d), (e) and (f) are balanced by the data subject’s right to object — and legitimate interests must be earned through a balancing exercise, not assumed (see legitimate interests).
The Regulator itself confirms it
This is not a clever lawyer’s reading — the Information Regulator has said it in terms. Its Guidance Note on COVID-19 (3 April 2020) put the structure of section 11 like this:
“It is not necessary for a responsible party to obtain consent from a data subject to process his or her personal information in the context of COVID -19, when: processing complies with the obligation imposed by law on the responsible party; processing protects a legitimate interest of the data subject; processing is necessary for the proper performance of a public law duty by a public body; or processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.”
One business, five grounds — and consent plays the smallest part
Map an ordinary plumbing company’s processing to the grounds. Customer names and addresses for quotes and jobs — contract (s 11(1)(b)). Invoices retained for five years — tax law (s 11(1)(c)). Employee records and payslips — contract and legal obligation (ss 11(1)(b) and (c)). CCTV at the workshop — legitimate interests (s 11(1)(f)). A marketing SMS to past customers about a geyser special — the existing-customer exception (s 69(3)). And a once-off consent request to a referred prospect — section 69(2), consent (s 11(1)(a)). One business, five different grounds — and consent plays the smallest part.