The four triggers
Prior authorisation is required before: processing unique identifiers of data subjects for a purpose other than the one for which the identifier was specifically intended at collection and with the aim of linking the information with information processed by other responsible parties; processing “information on criminal behaviour or on unlawful or objectionable conduct on behalf of third parties”; processing “information for the purposes of credit reporting”; or transferring special personal information or children’s information to a third party in a foreign country that does not provide an adequate level of protection.
Read the triggers narrowly, because they are narrow. An ID number used to onboard a customer is not a trigger; repurposing identifiers and linking them across responsible parties is. Vetting your own candidates is not a trigger; screening as a service for others is. Holding your customers’ payment history is not a trigger; operating credit reporting is. And ordinary offshore cloud use is not a trigger; special or children’s data to a non-adequate country is.
The section 58(2) bar: wait for the Regulator
Authorisation is once-off, but it is a genuine gate: the section 58(2) bar on proceeding before the Regulator responds has applied since 1 February 2022. A screening or credit-reporting venture cannot launch first and regularise later — the unauthorised processing is itself unlawful. Per the Regulator’s guidance, processing of this kind already under way before 1 July 2021 was not subject to the application requirement; new entrants apply through the Regulator’s prescribed process and wait.
No general licensing — naming the misconception
A persistent sales pitch claims businesses must “register with the Information Regulator” to process personal information. They must not. POPIA has no general registration, licensing or approval requirement for processing — the four triggers above are the entire universe of prior authorisation. The registration that is universal is the information officer’s (s 55(2)) — a different duty about a person, not a permission for processing. Conflating the two sells compliance packages; separating them is the law.