International Data Transfer Addendum Template for South Africa

When you transfer personal information from South Africa to another country, you need an International Data Transfer Addendum to comply with the Protection of Personal Information Act (POPIA). This document creates binding legal obligations between data exporters and importers, ensuring personal information receives adequate protection even after crossing South African borders.

When do you need this document?

You must use this addendum whenever your South African business transfers personal information internationally. Common scenarios include using cloud storage services hosted overseas, outsourcing customer service to foreign call centres, sharing employee data with international subsidiaries, or engaging overseas suppliers who process personal information. The document is also essential for multinational companies conducting intra-group data transfers and businesses using international payment processors or marketing platforms that handle South African customer data.

Key legal considerations

The addendum must establish clear roles and responsibilities for both parties. Data exporters retain primary liability under POPIA, while data importers must implement equivalent security measures. Key clauses should address data processing purposes and limitations, security safeguards and breach notification procedures, data subject rights and access mechanisms, and audit rights and compliance monitoring. The agreement must also specify data retention periods, deletion requirements upon contract termination, and procedures for handling regulatory inquiries. Sub-processor arrangements require additional protections, including due diligence requirements and flow-down obligations to ensure all parties maintain POPIA compliance standards.

Legal requirements in South Africa

Under Section 72 of POPIA, international transfers are only permitted when the receiving country provides adequate protection or when specific safeguards are implemented. The Information Regulator has issued guidance requiring contractual measures that ensure equivalent protection standards. Your addendum must demonstrate that the foreign jurisdiction maintains data protection laws substantially similar to POPIA, or implement compensating controls through contractual obligations. The agreement must also establish South African law as governing law for data protection matters and provide mechanisms for data subjects to exercise their rights. Additionally, you must conduct transfer impact assessments to evaluate risks in the destination country and implement supplementary measures where necessary to maintain POPIA's protection standards.