{"id":3857,"date":"2026-04-08T12:14:06","date_gmt":"2026-04-08T12:14:06","guid":{"rendered":"https:\/\/itlawco.com\/?p=3857"},"modified":"2026-04-08T12:21:51","modified_gmt":"2026-04-08T12:21:51","slug":"popia-national-security-exclusion","status":"publish","type":"post","link":"https:\/\/itlawco.com\/fr\/popia-national-security-exclusion\/","title":{"rendered":"POPIA and national security: the exclusion that requires closer scrutiny"},"content":{"rendered":"\n\t\t
<\/div><\/div><\/div>
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\n
\n\t

South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA)<\/a> is recognised as a comprehensive data protection framework. What is less widely understood is that it contains an exclusion capable of removing its application entirely and that the conditions attached to that exclusion are not being systematically verified.<\/p>\n

This article explains what the national security exclusion does, who it affects, where it currently falls short, and what the legal landscape looks like following the General Intelligence Laws Amendment Act 37 of 2024 (GILAB)<\/a> and the Constitutional Court\u2019s judgment in AmaBhungane<\/em>.<\/p>\n

Relevant to:<\/strong> compliance officers, information officers, government departments, private security contractors, legal practitioners, and organisations subject to POPIA.<\/p>\n<\/div>\n\n\n\n\n

\n\t

The exclusion in plain terms<\/h2>\n

What does POPIA\u2019s national security exclusion actually do?<\/h3>\n

Section 6(1)(c) of POPIA provides that the Act does not apply to the processing of personal information by or on behalf of a public body where that processing involves national security, defence, or public safety or where its purpose is the prevention, detection, or prosecution of offences.<\/p>\n

This is a total exclusion. Not a partial relaxation of requirements. A complete removal of POPIA\u2019s jurisdiction. None of the eight conditions for lawful processing apply. No data subject rights arise. The Information Regulator<\/a> has no oversight authority.<\/p>\n

The exclusion is, however, conditional. It applies only \u201cto the extent that adequate safeguards have been established in legislation for the protection of such personal information\u201d.<\/p>\n

That proviso is carrying significant constitutional weight. Whether it is being satisfied in practice is a question South African law has not yet authoritatively answered.<\/p>\n<\/div>\n\n\n\n\n

\n\t

What makes this exclusion unusual<\/h2>\n

Three features of section 6(1)(c) distinguish it from equivalent provisions in other jurisdictions.<\/p>\n

No procedure for invoking it<\/h3>\n

Unlike the United Kingdom, which requires a ministerial certificate as documented evidence that a national security exemption applies, South Africa imposes no equivalent requirement. A public body decides internally that its processing involves national security, and the Act ceases to apply. No application to the Regulator is required. No external verification takes place.<\/p>\n

\u201cNational security\u201d is not defined in POPIA<\/h3>\n

The most authoritative statutory definition appears in the National Strategic Intelligence Act 39 of 1994 (NSIA)<\/a>, which frames national security around specific threats: terrorism, espionage, sabotage, hostile foreign intervention, and serious violence directed at overthrowing the constitutional order.<\/p>\n

Critically, the NSIA definition explicitly provides that national security does not include lawful political activity, advocacy, protest or dissent<\/strong>. This is reinforced by the Johannesburg Principles on National Security, Freedom of Expression and Access to Information (1995)\u2014an internationally recognised expert framework produced in South Africa at the post-apartheid transition\u2014which provide that national security may only be invoked to protect the country\u2019s existence or territorial integrity against force, not to shield governments from embarrassment, conceal the functioning of public institutions, or suppress dissent. Processing of personal information about persons engaged in lawful protest or democratic advocacy cannot legitimately invoke the POPIA exclusion on national security grounds.<\/p>\n

The \u201cadequate safeguards\u201d condition has never been judicially interpreted<\/h3>\n

No South African court has determined what \u201cadequate safeguards established in legislation\u201d means, which statutes qualify, or what happens when a body invokes the exclusion but the relevant safeguards legislation is constitutionally deficient.<\/p>\n<\/div>\n\n\n\n\n

\n\t

The adequate safeguards problem<\/h2>\n

Which legislation currently qualifies as adequate safeguards?<\/h3>\n

The adequate safeguards condition is the provision\u2019s constitutional load-bearer. It is what allows section 6(1)(c) to coexist with the section 36 limitation clause, which requires that limitations on rights be reasonable, justifiable, and accomplished through the least restrictive means available.<\/p>\n

Several statutes have been identified as candidates, each with a different scope.<\/p>\n

The Tax Administration Act 28 of 2011 (section 69)<\/strong> obliges SARS to preserve the secrecy of information it holds and prohibits disclosure to non-SARS officials. For SARS’s specific revenue functions, this constitutes a credible confidentiality framework.<\/p>\n

The Financial Intelligence Centre Act 38 of 2001 (section 40)<\/strong> imposes access controls over FICA-held information and requires written agreements for inter-entity data sharing. For anti-money laundering and terrorism financing identification functions, this is the strongest safeguards candidate currently in operation.<\/p>\n

RICA \u2014 the Regulation of Interception of Communications and Provision of Communication-related Information Act 70 of 2002<\/a><\/strong> \u2014 was historically the primary safeguards instrument for communications interception by security services. The Constitutional Court\u2019s 2021 judgment in AmaBhungane Centre for Investigative Journalism NPC v Minister of Justice and Correctional Services<\/em> changed this position significantly.<\/p>\n

The AmaBhungane consequence and its sequel<\/h3>\n

The Court declared RICA unconstitutional in five respects: insufficient judicial independence; no post-surveillance notification; inadequate ex parte<\/em> safeguards; no procedures for managing, storing and destroying surveillance data; and no special protections for journalists or lawyers. For POPIA purposes the data management deficiency is most significant: RICA provided no clarity on what intercepted data must be retained, where, by whom, for what purpose, or when it must be destroyed. The Court endorsed the European Court of Human Rights\u2019 Weber<\/em> minimum standards as the benchmark any adequate framework must meet. Those standards remain unmet.<\/p>\n

The Court also declared the National Communications Centre\u2019s bulk surveillance operations unlawful: the NSIA\u2019s general power to \u201cgather, correlate, evaluate and analyse\u201d intelligence cannot authorise mass interception without specifying manner, circumstances, duration or data management rules. A general enabling power does not constitute adequate safeguards.<\/p>\n

Parliament was given 36 months to cure the defects. It did not. RICA\u2019s invalidity took full effect in February 2024 and the designated judge\u2019s term expired in September 2024, rendering RICA entirely inoperable.<\/p>\n

In President of the Republic of South Africa v Speaker of the National Assembly and Others<\/em> [2025] ZACC 12, decided unanimously on 25 July 2025, the Constitutional Court intervened a second time. It deemed RICA to include a new designated judge definition\u2014three retired High Court judges, nominated by the Chief Justice, appointed for a non-renewable 24-month term\u2014and extended the interim journalist, lawyer, and post-surveillance notification protections from the original order.<\/p>\n

Of the five deficiencies, two now have interim remedies. Three remain entirely unaddressed: the ex parte<\/em> gap (section 16(7) still requires directions to be issued without notice or hearing, exactly as the Court left it in 2021); the data management gap; and the bulk interception accountability gap. The constitutional declaration of invalidity stands. The President\u2019s advisors found Parliament\u2019s own Amendment Bill constitutionally inadequate on notification grounds and referred it back in November 2024. South Africa is four years on from AmaBhungane<\/em> without a valid legislative cure, and RICA in its current interim form does not satisfy the Weber<\/em> benchmark that section 6(1)(c) requires.<\/p>\n<\/div>\n\n\n\n\n

\n\t

The legislative history: what was intended and what was enacted<\/h2>\n

The South African Law Reform Commission\u2019s 2009 Project 124 Report<\/a> is the foundational pre-legislative document underlying POPIA. Comparing the SALRC’s draft Bill against the enacted Act reveals changes made during the parliamentary process with significant legal consequences.<\/p>\n

The SALRC required adequate safeguards to be established in specific<\/strong> legislation. Parliament dropped the word \u201cspecific a change that lowers the threshold considerably. \u201cLegislation\u201d is satisfied by any applicable statute with relevant protective provisions. \u201cSpecific legislation\u201d would have required a dedicated statutory scheme tailored to the processing in question.<\/p>\n

The SALRC\u2019s consultation record also contains a finding directly relevant to how the exclusion should be interpreted today: \u201cBroad and vague exemptions erroneously assume that one must give up core information principles to protect national security\u201d. Most respondents to the SALRC\u2019s consultation explicitly opposed blanket exemptions from all privacy principles. This legislative history supports a narrow rather than expansive reading of the exclusion\u2019s scope.<\/p>\n<\/div>\n\n\n\n\n

\n\t

GILAB: a framework that does not yet exist<\/h2>\n

What does GILAB change, and when does it take effect?<\/h3>\n

The General Intelligence Laws Amendment Act 37 of 2024 (GILAB)<\/a> was assented to on 25 March 2025. Its commencement date has not been proclaimed. None of its provisions are currently operative law.<\/p>\n

When commenced, GILAB will insert section 2B into the NSIA, creating the first express statutory basis for NCC bulk interception operations, closing the legal gap AmaBhungane<\/em> identified when it declared NCC bulk surveillance unlawful for lack of any statutory authority. Section 2B requires judicial approval by a retired judge nominated by the Chief Justice before bulk interception may proceed.<\/p>\n

GILAB will also insert section 2C, requiring that regulations governing the processing, storage, sharing, and destruction of bulk interception data take into account principles that closely mirror POPIA\u2019s eight conditions, including accountability, processing limitations, purpose specification, and post-surveillance notification. This would be the first data management framework for intelligence-collected personal information that meets the Weber<\/em> minimum standards the Constitutional Court endorsed in AmaBhungane<\/em>.<\/p>\n

Three important limitations qualify this development.<\/p>\n

    \n
  1. First, section 2C applies only to bulk interception data generated by the NCC, not to the full range of targeted surveillance authorised under RICA. The three AmaBhungane<\/em> deficiencies that remain unaddressed\u2014the ex parte<\/em> safeguards gap, the data management gap in RICA\u2019s sections 35 and 37, and the bulk interception accountability gap\u2014are not touched by GILAB. The data management framework goes into the NSIA, not into RICA itself.<\/li>\n
  2. Second, the principles are directives to regulation-making, not operative obligations. Regulations must be made within 12 months of commencement. Until they are, no POPIA-equivalent protections exist.<\/li>\n
  3. Third, under section 6(4) of the NSIA, regulations made under the Act may be kept secret, not published in the Gazette. If the safeguards on which the exclusion relies are contained in unpublished ministerial regulations, neither the public nor the courts can assess whether they are adequate.<\/li>\n
  4. A fourth limitation: GILAB\u2019s pending amendments to RICA itself are confined entirely to renaming, substituting new agency names in existing definitions. No data management framework, notification provisions, or ex parte<\/em> safeguards are added to RICA by GILAB.<\/li>\n<\/ol>\n<\/div>\n\n\n\n\n
    \n\t

    The enforcement action against SAPS<\/h2>\n

    Has the exclusion been successfully challenged?<\/h3>\n

    The most concrete test of the exclusion\u2019s limits came through the Information Regulator\u2019s enforcement action against the South African Police Service arising from the Krugersdorp mob rape victims\u2019 case.<\/p>\n

    SAPS officials shared a WhatsApp message containing the victims\u2019 names, ages, and residential addresses, which entered the public domain. SAPS attempted to rely on section 6 as a blanket exclusion, arguing that as a public body investigating a crime, POPIA did not apply.<\/p>\n

    The Regulator rejected this interpretation. The investigation concluded that the privacy protections within the SAPS Act and related regulations did not constitute \u201cadequate safeguards\u201d as section 6 requires. The enforcement notice required SAPS to notify the victims, issue a public apology, investigate the responsible officers, and integrate POPIA compliance into standard training.<\/p>\n

    The precedent is clear: section 6 is not a jurisdictional shield that automatically protects any security-related body. It is conditional. A body that cannot demonstrate adequate legislative safeguards remains fully subject to POPIA.<\/p>\n<\/div>\n\n\n\n\n

    \n\t

    Practical implications for organisations<\/h2>\n

    Who does this actually affect, and how?<\/h3>\n

    Private contractors under government security mandates<\/h4>\n

    Organisations processing personal information under a government security contract face legal uncertainty about whether they qualify as processing \u201con behalf of a public body\u201d for national security purposes. The law is untested on this point, and relying on the exclusion without legal advice carries risk.<\/p>\n

    Organisations subject to terrorism reporting obligations<\/h4>\n

    PCDATARA section 12<\/a>, as amended in 2022, provides that no confidentiality obligation\u2014including those imposed by POPIA\u2014affects the duty to report suspected terrorism to police. Any organisation that has reason to suspect that another person intends to commit or has committed a terrorism offence must report this, regardless of any POPIA processing limitation.<\/p>\n

    Government departments holding personal information<\/h4>\n

    NSIA section 3(5) provides that, notwithstanding any law to the contrary, no department of State may withhold information from the intelligence services when it is reasonably required for an investigation. This override operates independently of POPIA and cannot be resisted on data protection grounds.<\/p>\n

    Mobile network operators and the section 40 regime<\/h4>\n

    Section 40 of RICA requires mobile operators to collect and store subscriber identity information for five years after contract termination, and permits law enforcement agencies to access it by written request: no interception direction required, no judicial oversight. This creates a parallel personal information processing regime sitting alongside POPIA rather than within it. For organisations holding SIM registration data, understanding how section 40 interacts with POPIA\u2019s conditions is a distinct compliance question from the section 6 exclusion analysis.<\/p>\n

    Even without invoking the total exclusion in section 6, POPIA\u2019s own conditions contain national security exceptions. Sections 12, 15, and 18 allow departures from direct collection, purpose limitation, and notification requirements where national security necessity genuinely exists. These exceptions apply to any responsible party, not only security agencies.<\/p>\n<\/div>\n\n\n\n\n

    \n\t

    FAQs about POPIA\u2019s national security exclusion<\/h2>\n<\/div>\n\n\n\n

    <\/i>Does POPIA apply to government security agencies?<\/a><\/h3>
    \n
    \n\t

    Not in full. Section 6(1)(c) excludes POPIA’s application to public bodies processing personal information for national security, defence, law enforcement, or public safety purposes \u2014 but only where adequate legislative safeguards exist in other legislation. RICA, the primary safeguards instrument for communications interception, was declared constitutionally invalid in AmaBhungane<\/em> (2021) in five respects. A second Constitutional Court intervention in July 2025 (President v Speaker<\/em> [2025] ZACC 12) restored RICA’s operability through interim relief, but three of those five deficiencies \u2014 data management, ex parte safeguards, and bulk interception accountability \u2014 remain entirely unaddressed. RICA in its current interim form does not meet the minimum standards the Court itself endorsed as the benchmark for adequate safeguards.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div>

    <\/i>Can a private company claim the POPIA national security exclusion?<\/a><\/h3>
    \n
    \n\t

    Only if it is processing personal information on behalf of a qualifying public body for a national security purpose. A private company cannot invoke the exclusion based on its own assessment of security necessity. The legal basis for any such claim remains untested in South African courts.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div>

    <\/i>Does GILAB fix the national security data protection gap?<\/a><\/h3>
    \n
    \n\t

    Partially, and only when commenced. GILAB will introduce POPIA-equivalent data management principles for bulk interception data. It does not create a comprehensive data protection framework for all intelligence processing. Its provisions are not yet law.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div>

    <\/i>What does the SAPS enforcement case mean for other public bodies?<\/a><\/h3>
    \n
    \n\t

    It establishes that the section 6 exclusion cannot be invoked by default. A public body must be able to point to specific legislation providing adequate privacy safeguards. Invoking the exclusion without that foundation exposes the body to the full force of POPIA enforcement.<\/p>\n<\/div>\n\n\n\n<\/div><\/div><\/div><\/div>\n

    \n\t

    The bottom line<\/h2>\n

    Section 6(1)(c) of POPIA is constitutionally defensible in principle. A conditional exclusion\u2014one that removes the Act\u2019s application only where adequate legislative safeguards exist\u2014is a legitimate approach to balancing privacy and security. The difficulty lies in how that condition is being applied.<\/p>\n

    The \u201cadequate safeguards\u201d standard is currently assessed by the bodies that benefit from satisfying it. There is no external verification, no documented decision, and no independent review. The primary legislation historically relied upon for communications interception (RICA) was declared constitutionally invalid in 2021 and remains so today. A second Constitutional Court intervention in July 2025 restored RICA\u2019s operability through an interim order of indefinite duration, but the declaration of invalidity stands and key deficiencies\u2014including the absence of a data management framework\u2014remain unaddressed. Parliament has failed to produce a constitutionally acceptable cure in four years. The President\u2019s own advisors found Parliament\u2019s attempt inadequate and sent the Bill back for reconsideration.<\/p>\n

    What South Africa\u2019s national security exclusion currently lacks is not legal imagination, but institutional accountability. The path toward closing that gap runs through GILAB\u2019s commencement, a constitutionally valid RICA amendment, a formal cooperation framework between the Information Regulator and the Inspector-General of Intelligence, and\u2014in time\u2014a court willing to define what \u201cadequate safeguards\u201d actually requires.<\/p>\n

    Until that framework is in place, the exclusion remains one of the most consequential and least scrutinised provisions in South African data protection law. Those operating within its boundaries should do so with care, and those affected by it deserve to know that the safeguards meant to protect them have not yet been independently verified.<\/p>\n<\/div>\n\n\n\n\n

    \n\t

    How ITLawCo can help<\/h2>\n

    ITLawCo advises public bodies, private organisations, and legal practitioners on data protection compliance across South Africa\u2019s complex regulatory landscape, including where POPIA intersects with national security, intelligence, and law enforcement obligations.<\/p>\n

    \n\n\n\n\n\n\n\n\n\n\n
    Service<\/th>\nWhat we do<\/th>\n<\/tr>\n<\/thead>\n
    POPIA compliance assessments<\/strong><\/td>\nWe review your organisation\u2019s processing activities against POPIA\u2019s eight conditions for lawful processing, identify where national security exceptions or exclusions may apply, and advise on the legal basis required to rely on them safely.<\/td>\n<\/tr>\n
    Section 6 exclusion analysis<\/strong><\/td>\nIf your organisation is a public body\u2014or processes personal information on behalf of one\u2014we assess whether the section 6(1)(c) exclusion applies, whether adequate legislative safeguards exist, and what risk exposure arises where those safeguards are absent or legally contested.<\/td>\n<\/tr>\n
    GILAB readiness<\/strong><\/td>\nWith GILAB assented to but not yet commenced, now is the time to understand what changes when it takes effect. We advise on the new intelligence structures, the pending bulk interception data management framework, and how organisations should prepare.<\/td>\n<\/tr>\n
    Terrorism reporting and compelled disclosure<\/strong><\/td>\nWe advise on the intersection of POPIA\u2019s processing conditions with mandatory reporting obligations under PCDATARA and compelled disclosure provisions under the NSIA, including how to respond when security agencies request personal information your organisation holds.<\/td>\n<\/tr>\n
    RICA operator obligations<\/strong><\/td>\nWe advise mobile network operators and organisations holding SIM registration data on the interaction between RICA\u2019s section 40 retention and access requirements and POPIA\u2019s conditions for lawful processing, including how law enforcement access requests should be managed.<\/td>\n<\/tr>\n
    Information officer support<\/strong><\/td>\nWe assist information officers in understanding the boundaries of POPIA\u2019s application, drafting processing records that account for national security exceptions, and responding to data subject requests where security considerations are relevant.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

    Contact ITLawCo<\/a> to discuss your organisation’s specific position.<\/p>\n<\/div>\n\n\n\n\n

    \n\t

    This article is published by ITLawCo for general information purposes. It does not constitute legal advice and should not be relied upon as such. The law described reflects the position as at July 2025, including the Constitutional Court’s judgment in President of the Republic of South Africa v Speaker of the National Assembly and Others [2025] ZACC 12 decided on 25 July 2025. For advice specific to your organisation’s circumstances, contact ITLawCo<\/a>.<\/em><\/p>\n<\/div>\n\n\n\n\n\t\t\t<\/div> \n\t\t<\/div>\n\t<\/div> \n<\/div><\/div>\n\t\t

    <\/div><\/div><\/div>
    \n\t
    \n\t\t
    \n\t\t\t
    \n\t\t\t\t\n\t
    \n\t\t
    \n\t\t\t\n\n\n