Lawful and reasonable processing
Section 9 sets the tone for the whole condition: process lawfully and “in a reasonable manner that does not infringe the privacy of the data subject”. Reasonableness is the lens for every choice that follows — what you collect, from where, and how you use it.
Minimality: adequate, relevant and not excessive
“Personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive.”
Minimality is purpose-relative: the same field can be essential in one context and excessive in another. An attorney’s FICA file needs an ID number; a newsletter signup does not. This is also the condition that disciplines CCTV (point cameras at the risk, not at everything) and references (share what the prospective employer needs, not the whole HR file).
Direct collection — and the section 12(2) exceptions
Section 12(1) requires collection directly from the data subject. But the exceptions in section 12(2) accommodate the real world — collection from another source is permitted, among others, where:
“the information is contained in or derived from a public record or has deliberately been made public by the data subject” ... where collection from another source “would not prejudice a legitimate interest of the data subject” ... where it is necessary for “the conduct of proceedings in any court or tribunal” ... or “to maintain the legitimate interests of the responsible party or of a third party to whom the information is supplied”.
Tracing, vetting and bought lists
The exceptions are why ordinary risk management survives POPIA. Tracing a debtor through a tracing agent, or vetting a counterparty against public registers, fits squarely within section 12(2) — the debtor’s address was never going to come from the debtor. The same analysis turns hostile for bought marketing lists: there is rarely an exception that fits, the recipient’s section 69 duties kick in, and the seller’s privacy notice probably never disclosed the sale.