Protection of Personal Information Act, 2013 — transborder flows of personal information

s. 72 bars sending personal information to a recipient in a foreign country unless one of the listed grounds applies. The main three are that the recipient is subject to a law, binding corporate rules, or a binding agreement providing an adequate level of protection; the remaining grounds are consent, necessity for a contract with the data subject, a contract concluded in the data subject's interest, and benefit to the data subject where consent is impracticable. 'Adequate' has a defined content: it must uphold principles substantially similar to POPIA's conditions for lawful processing AND include an onward-transfer restriction substantially similar to s. 72 itself — so a transfer agreement that secures the data at the first hop but says nothing about the recipient's own subprocessors does not satisfy the section. South Africa maintains no adequacy list, so the assessment is the exporter's to make and document.