There is no stricter rule for sharing
“You may not share personal information with anybody.”
Sharing is just one form of “processing”, and it is lawful whenever a section 11 ground applies and the other conditions are met. POPIA regulates sharing; it does not ban it.
“(b) dissemination by means of transmission, distribution or making available in any other form;”
The three checks every disclosure must pass
1.Ground
Does a section 11 ground cover this disclosure? Often it is s 11(1)(f): the legitimate interests of the recipient — the subsection expressly contemplates “a third party to whom the information is supplied”.
2.Compatibility
Is the disclosure compatible with the purpose of collection (s 15), or deemed compatible by s 15(3)? See the next section.
3.Conditions
Minimality (share only what’s needed), openness (your privacy notice should mention categories of recipients — s 18(1)(h)(i)), and safeguards in transit.
Further processing and deemed compatibility
Section 15 requires new uses of existing information to be “in accordance or compatible with the purpose for which it was collected”, assessed on the relationship between the purposes, the nature of the information, the consequences for the data subject, how it was collected, and contractual rights (s 15(2)). Section 15(3) then deems certain further processing compatible:
...where the information comes from a public record; where it is “necessary... for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated”; to avoid prejudice to law enforcement; to comply with a legal obligation; or to “prevent or mitigate a serious and imminent threat to public health or public safety; or the life or health of the data subject or another individual.”
Note — Handing a defaulting debtor’s file to your attorney is textbook deemed-compatible further processing under s 15(3)(c)(iii).
The worked examples
Each everyday sharing scenario has its own guide applying the three checks:
Debt collection
Contract, legal obligation and legitimate interest all support it; recovery proceedings are deemed compatible.
Employee references
The prospective employer is a third party with an obvious legitimate interest.
SAPS, SARS & regulators
Legal obligation applies; ask for the legal basis and record it.
Body corporates & HOAs
Members exercising membership rights have a legitimate interest.
Groups of companies
Each company is a separate responsible party — sharing needs a ground, usually legitimate interests.
Selling customer lists
The counter-example: rarely covered by any ground — this is what POPIA is aimed at.
Where Parliament did write consent-only sharing rules
One wrinkle proves the structure. For a few categories of special personal information, the Act imposes specific third-party limits: religious organisations (s 28(3)), trade unions (s 30(2)) and political institutions (s 31(2)) “may not” supply members’ relevant information “to third parties without the consent of the data subject”. Those are targeted rules for sensitive contexts — proof that when Parliament wanted a consent-only sharing rule, it said so expressly. It did not say so for ordinary personal information.