POPIA Cross-Border Transfers — Audit & Governance Dashboard

Why personal information leaving South Africa needs a lawful basis

POPIA Section 72 restricts the transfer of personal information to a recipient in a foreign country unless one of its specific conditions is met — adequate protection at the destination, consent, necessity for a contract, or binding corporate rules. Cloud hosting, offshore support and shared services routinely move data across borders, often without the entity having mapped the flow or confirmed its basis. AuditPro Core inventories every cross-border personal-information flow and records the Section 72 condition relied upon, so the responsible party can evidence lawful transfer rather than discover an unauthorised one during an Information Regulator enquiry.

The Numbers

AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.

Cross-border flows

With lawful basis

of 29

No safeguards

Jurisdictions

Flows by receiving jurisdiction

Flows lacking Section 72 basis

Data flow	Destination	Lawful basis
HR analytics	USA	None
Cloud backup	EU	Pending
Survey processing	India	None

Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.

When Section 72 is triggered

Any transfer of personal information to a recipient outside South Africa engages Section 72 — including storage on offshore cloud infrastructure, not only active sending of files.

The permitted grounds

Transfer is lawful where the recipient is subject to adequate protection, the data subject consents, the transfer is necessary for a contract, or it benefits the data subject and consent is impractical. One ground must apply to each flow.

Mapping the flows

You cannot secure a basis for a flow you have not identified. A current inventory of who receives what data, where, and under which condition is the foundation of Section 72 compliance.

Onward transfers

A recipient abroad may itself move data further. The lawful basis should address onward transfer, typically through contractual commitments that bind the recipient to equivalent protection.

How AuditPro Core Bridges the Gap

Flow inventory: each cross-border personal-information flow is catalogued with its destination, recipient and data categories.
Lawful-basis recording: the Section 72 condition relied upon is captured per flow, exposing transfers with no recorded basis.
Exception workflow: flows lacking a valid ground are raised for legal review and remediation.
Audit-ready export: the transfer register evidences Section 72 compliance for the Information Regulator or internal audit.

Key Takeaways

Offshore cloud storage is a cross-border transfer, even with no file ever sent.
Each flow must rest on one of the Section 72 grounds — record which.
You cannot lawfully secure a transfer you have not mapped.
Address onward transfers through contractual equivalent-protection commitments.