‘Encore, encore!’ – secondary use of health data for research: A practical guide to POPIA
Article Sidebar
Main Article Content
Abstract
Health data hold immense potential for advancing medical science and informing public health strategies; however, their secondary use for research purposes has been poorly exploited, partly due to uncertainty and compliance concerns brought about by the Protection of Personal Information Act (POPIA). Researchers often assume that re-consent is the only option for secondary use. Yet POPIA provides several lawful grounds for processing special personal information, which includes health data, without necessarily obtaining re-consent. The present article serves as a practical guide for researchers navigating POPIA’s requirements for the secondary use of health data for research. A systematic approach is recommended: first, researchers should establish whether the original consent encompasses the intended secondary use. If it does not, they should determine which lawful grounds for processing special personal information best suit their context and can be relied upon. Options include obtaining re-consent, relying on a research purpose, or seeking authorisation from the Information Regulator. In addition, researchers may consider de-identifying the dataset, which would exempt it from the ambit of POPIA. Situations where pseudonymisation might achieve a similar outcome are also unpacked. By taking proactive, well-documented steps, researchers can better capitalise on existing health datasets to advance vital health research in South Africa.
Article Details
Issue
Section
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
The SAJBL is published under an Attribution-Non Commercial International Creative Commons Attribution (CC-BY-NC 4.0) License. Under this license, authors agree to make articles available to users, without permission or fees, for any lawful, non-commercial purpose. Users may read, copy, or re-use published content as long as the author and original place of publication are properly cited.
Exceptions to this license model is allowed for UKRI and research funded by organisations requiring that research be published open-access without embargo, under a CC-BY licence. As per the journals archiving policy, authors are permitted to self-archive the author-accepted manuscript (AAM) in a repository.
How to Cite
References
1. Protection of Personal Information Act 4 of 2013 [South Africa]. https://www.gov. za/sites/default/files/gcis_document/201409/3706726-11act4of2013popi.pdf (cited 31 August 2022).
2. Thaldar D, Edgcumbe A, Donnelly DL. How to interpret core concepts in POPIA? Recommendations on the draft Code of Conduct for Research. South Afr J Sci 2023;119(7/8) https://doi.org/10.17159/sajs.2023/15062
3. Thaldar DW, Townsend BA. Exempting health research from the consent provisions of POPIA. Potchefstroom Electron Law J 2021;24:1-32. https://doi. org/10.17159/1727-3781/2021/v24i0a10420
4. Staunton C, Adams R, Anderson D, et al. Protection of Personal Information Act 2013 and data protection for health research in South Africa. Int Data Priv Law 2020;10(2):160-179.
5. Swales L. The Protection of Personal Information Act 4 of 2013 in the context of health research: Enabler of privacy rights or roadblock? Potchefstroom Electron Law J 2022;25:1-32.
6. Murdoch B, Jandura A, Caulfield T. Reconsenting paediatric research participants for use of identifying data. J Med Ethics 2023;49(2):106-109.
7. Wallace SE, Gourna EG, Laurie G, Shoush O, Wright J. Respecting autonomy over time: Policy and empirical evidence on re‐consent in longitudinal biomedical research. Bioethics 2016;30(3):210-217.
8. Adams R, Veldsman S, Ramsay M, Soodyall H. Drafting a code of conduct for research under the Protection of Personal Information Act No. 4 of 2013 (with corrigendum). South Afr J Sci 2021;117(5/6).
9. National Health Research Ethics Council South African Ethics in Health Research Guidelines: Principles, Processes and Structures, 3rd ed (2024). National Department of Health, Pretoria. https://www.health.gov.za/nhrec-guidelines/
10. Thaldar D. Research and the meaning of ‘public interest’ in POPIA. South Afr J Sci 2022;118(3/4). https://doi.org/10.17159/sajs.2022/13206
11. Edgcumbe A, Botes M, Donnelly DL, Townsend B, Shachar C, Thaldar D. ‘Potato potahto’? Disentangling de-identification, anonymisation, and pseudonymisation for health research in Africa. J Law Biosci 2025;12(1):lsae029.
12. Simon GE, Shortreed SM, Coley RY, et al. Assessing and minimizing re- identification risk in research data derived from health care records. EGEMs Gener Evid Methods Improve Patient Outcomes 2019;7(1):6 .
13. Gadotti A, Rocher L, Houssiau F, Creţu AM, De Montjoye YA. Anonymisation: The imperfect science of using data while preserving privacy. Sci Adv 2024;10(29):eadn7053.
14. Academy of Science of South Africa (ASSAf ). ASSAf POPIA compliance framework for researchers and research institutions. ASSAf; 2025. https://hdl.handle. net/20.500.11911/438 (cited 24 July2025).
15. General Data Protection Regulation (EU) 2016/679, European Union.
16. Rodriguez A, Tuck C, Dozier MF, et al. Current recommendations/practices for anonymising data from clinical trials in order to make it available for sharing:
A scoping review. Clin Trials 2022;19(4):452-463.
17. Kohlmayer F, Lautenschläger R, Prasser F. Pseudonymisation for research
data collection: Is the juice worth the squeeze? BMC Med Inform Decis Mak 2019;19(1):178.