Back to All Articles

VerifyNow guide

POPIA Section 72 Cross-Border Data Transfer for KYC in SA

POPIA Section 72 cross-border data transfer for KYC is where many South African compliance teams get stuck—especially when KYC data touches cloud hosting, ...

Start verifyingView services
POPIA Section 72 Cross-Border Data Transfer for KYC in SA

The decision this page supports

POPIA does not impose a general South African data-localisation rule. Section 72 governs transfers of personal information to a third party in a foreign country and provides several alternative conditions for a lawful transfer.

VerifyNow service boundary

VerifyNow does not choose a hosting region, provide configurable residency, tokenise a customer’s identifiers, manage retention policy, certify an adequate country or supply a cross-border legal conclusion.

Review the evidence in order

  1. Map the exact transfer and foreign recipient.
  2. Select and document an applicable section 72 condition.
  3. Apply operator and security safeguards.
  4. Review access, retention and incident procedures against the real system.

What a supported result means

A responsible party should map the data, recipient, purpose, access locations and retention period. It should then record the section 72 condition relied on and the safeguards in the relevant agreement or governance record.

Authoritative references