Some personal information processing activities are considered of such a high risk that the Information Regulator must be approached for prior authorisation before the activities commence or continue. This includes certain research activities, including both new and on-the-go projects. From 1 February 2022, research activities subject to prior authorisation must be suspended pending prior authorisation. Prior authorisation for research applies when:
- Unique identifiers (such as a South African ID number) are used for research purposes and to link information of multiple institutions and the linking activity was not intended at the time when the information was collected (i.e. was not considered as part of the participant informed consent procedures); or
- When the institution transfers special personal information, or the information of children, to a foreign country that is not subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection (a formal data transfer agreement or research-related contract provides adequate protection).
The Information Regulator can take up to 17 weeks to process applications for prior authorisation. To help mitigate the impact on research projects, the Division for Information Governance has made itself available to assist researchers to determine if prior authorisation applies to their research and to apply for prior authorisation if necessary. To book a session with the Division, use the Ask a Privacy Expert option at www.sun.ac.za/privacy.
