Protection of Personal Information Act, 2013 — prohibition on processing personal information of children

South Africa inverts the usual structure. s. 34 is a flat PROHIBITION — a responsible party may not process the personal information of a child at all — and s. 35 then lists the grounds that lift it: prior consent of a competent person (in practice a parent or guardian), an authorisation granted by the Information Regulator under s. 27(2), necessity for establishing, exercising or defending a right or obligation in law, compliance with an obligation of international public law, historical, statistical or research purposes serving the public interest with appropriate safeguards, or information the child deliberately made public with a competent person's consent. Starting from prohibition rather than from conditional permission changes the compliance posture: the question is not 'have we obtained consent?' but 'which s. 35 ground are we relying on, and can we evidence it?' The Regulator can only grant a s. 27(2) authorisation where processing is in the public interest and appropriate safeguards exist. A child is anyone under 18.