Pseudonymisation means that personal information is processed in such a way that the personal information can no longer be attributed to a specific research participant without the use of additional information, provided that such additional information is kept separately, confidential and secure from unauthorised access.

For example:

• Pseudonymised data: “John Smith” is replaced with “Participant 001”, and the list linking John Smith to Participant 001 is stored separately and securely.
• De-identified data: All direct and indirect identifiers are removed or altered so that there is no reasonable way to re-identify the individual. In this case, the link to John Smith is permanently broken.

When the direct identifiers have been eliminated or transformed, but indirect identifiers remain intact, personal information has been pseudonymised and POPIA still applies. The information will be de-identified only once all direct and indirect identifiers have been removed or manipulated to break the link to real-world identifiers and POPIA does not apply.

If pseudonymised (re-identifiable) data are shared, access must be controlled through mechanisms like a Data Access Committee (DAC).

Only if individuals have no reasonable expectation of privacy (e.g. public Twitter accounts), but even then, ethical considerations apply. Anonymisation and REC review are strongly advised.

Biometric data requires special consideration as it’s often inherently identifying as it is unique to an individual. However, it would still require linked personal data to identify the individual. Genetic data can rarely be truly anonymized due to familial links and advanced re-identification techniques. Such data should generally only be shared through controlled access mechanisms (like Data Access Committees) with strict governance, even if processed to remove direct identifiers. Open-access sharing of biometric data is generally not recommended unless exceptional circumstances justify it and robust legal safeguards exist.

Yes, but only if properly anonymised/de-identified. Participants must give explicit consent for open-access use.

Genetic information is derived from an individual’s genetic material that can reveal health-related information, which is classified as special personal information.

Yes, it is personal information but only if it can reasonably be linked to an identifiable individual, even if the link is indirect or through advanced methods. Genetic/genomic data is only considered identifiable if it is linked through specific technical processing to other personal information that can directly or indirectly identify a living individual.

The data should be pseudonymised or de-identified, access limited to only those who require it, and a risk assessment and legal justification documented, for example in research documents and ethics applications.

Not directly. POPIA applies to recorded information about individuals, including data generated from samples, but not the physical samples themselves, unless linked to personal data or data records.

In South Africa, Material Transfer Agreements (MTAs) are used to govern the transfer/sharing of human biological material between contracting parties. To ensure sufficient data protection, MTAs should include contractual clauses that address the use and access of data related to such material being transferred/shared, consistent with POPIA.

Yes, data can be reused for new research, but only under specific conditions that ensure compliance with POPIA and ethical research standards.

When is reuse allowed?

• The new purpose must be compatible with the original consent.
• The data must not be published in an identifiable form.
• Reuse must comply with POPIA’s purpose limitation and further processing requirements.
• Research participants must be notified where appropriate and practicable.

What conditions must be met?

A legitimate interest assessment (see Section 3.3.4) should be undertaken. Reuse is permitted when:

• The personal information will only be used for research purposes; and
• The data will not be published in an identifiable form; or
• The research serves a public interest and processing is necessary for that purpose; or
• It would be impossible or require disproportionate effort to re-contact participants for consent; and
• You can demonstrate that appropriate safeguards are in place and that reuse will not adversely affect the privacy of participants in a disproportionate way.

Commercial use of research data requires explicit consent obtained at the time of initial data collection. If participants did not originally consent to commercial use, new consent must generally be obtained before any commercial application. In exceptional circumstances where re-consent is impossible, researchers must demonstrate a legitimate interest under POPIA’s conditions and seek both ethics committee and institutional legal review.