The POPI Act / Sections / Section 26
Section 26
Prohibition on processing of special personal information
Chapter 3 · Conditions for Lawful Processing · Part B, Special Personal Information
A responsible party may, subject to section 27, not process personal information concerning— (a) the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject; or (b) the criminal behaviour of a data subject to the extent that such information relates to— (i) the alleged commission by a data subject of any offence; or (ii) any proceedings in respect of any offence allegedly committed by a data subject or the disposal of such proceedings.
Source: justice.gov.za, Protection of Personal Information Act 4 of 2013 (official PDF), cross-checked verbatim before publishing.
Beyond the text
What this means for your estate
- Biometric information is explicitly named here (subsection (a)), a fingerprint or facial-recognition access system isn't just “regular” personal information under POPIA, it's in the restricted “special” category, which is a stricter default: prohibited unless one of s.27's specific exceptions applies.
- This is a default prohibition, not an absolute one, s.27 (the next section) lists the general exceptions, and ss.28-33 add category-specific ones (religious bodies, trade unions, health providers, and so on).
- Criminal-behaviour information (subsection (b)) is narrower than it sounds, it covers alleged offences and related proceedings specifically, not a general employment background check category.
Relevant tool
PopiGuard's Personal Information Register flags biometric and other special-category data automatically, so it gets the stricter handling this section requires by default.