Data protection and security when outsourcing to South Africa

UK GDPR: transferring UK personal data to South Africa

When a South African provider receives, stores or even remotely accesses personal data of UK customers, UK GDPR treats this as a restricted transfer. Because South Africa is not covered by UK adequacy regulations, you need an appropriate safeguard. For most outsourcing arrangements that means:

1. The International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses (useful if you also transfer EU data).
2. A transfer risk assessment considering the laws and practices in South Africa and the protections in place. The ICO provides a tool and guidance for this.
3. Supplementary measures where needed — encryption, access controls, data minimisation and keeping data hosted outside South Africa.

The UK’s Data (Use and Access) Act 2025 updated the framework for international transfers. Check the ICO’s current guidance, but for South Africa the practical approach above remains standard.

A common contract failure

Clauses that let a provider relocate services “anywhere in the world” through agents or subcontractors, or that say data will be “used with due cognisance of relevant legislation”, do not meet UK GDPR requirements. Contracts should specify:

• the approved delivery locations and data hosting locations;
• that any change of location or new subcontractor requires your prior written consent;
• the transfer mechanism, attached as a schedule;
• processing instructions, security measures, breach notification and audit rights.

EU GDPR

For EU personal data, use the EU Standard Contractual Clauses (the module for controller-to-processor or processor-to-processor as appropriate) with a transfer impact assessment. If you transfer both UK and EU data, the SCCs with the UK Addendum can cover both.

POPIA: South Africa’s data protection law

The Protection of Personal Information Act (POPIA) has been fully enforceable since 1 July 2021 and is overseen by the Information Regulator. Key points for clients:

• It sets eight conditions for lawful processing — accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation — broadly aligned with GDPR principles.
• A provider acting as an operator (similar to a processor) must process only with the knowledge or authorisation of the responsible party, keep information confidential, and be bound by a written contract requiring security safeguards.
• Security compromises must be notified to the Regulator and affected individuals.
• Section 72 restricts transfers of personal information out of South Africa unless conditions are met, such as the recipient being bound by adequate law or binding agreements — relevant when data flows back to you or to other countries.
• Direct marketing by electronic communication requires consent or an existing customer relationship, which matters for outbound programmes.

Australia: APP 8

Under the Privacy Act 1988, Australian Privacy Principle 8 generally requires you to take reasonable steps to ensure an overseas recipient handles personal information consistently with the APPs, and you may be accountable for its acts. Build APP-aligned obligations, audit rights and breach notification into the contract. APRA-regulated entities also need to meet CPS 230 requirements for material service providers.

United States

Requirements depend on your sector and states: HIPAA Business Associate Agreements for health information, GLBA safeguards for financial data, state privacy laws such as the CCPA/CPRA, and payment card rules. Outbound programmes must follow the TCPA and telemarketing rules; collections must follow the FDCPA and Regulation F.

Security standards and assurance

Ask for current reports or certificates, their scope (which sites and services are covered) and any exceptions noted by auditors.

Practical controls that reduce risk

• Host data outside the contact centre: keep data in the UK, EU or your own cloud; agents access through virtual desktops with no local storage.
• Clean-desk and device controls: no personal phones on the floor, disabled USB ports, printing blocked.
• Payment security: DTMF masking or secure IVR so agents never hear or see card numbers.
• Least-privilege access with multi-factor authentication and regular access reviews.
• Screen and call recording with controlled retention and redaction.
• Vetting and training: background checks, confidentiality agreements and regular data protection training.
• Monitoring and testing: security monitoring, penetration tests and continuity exercises.

Due diligence checklist

• Which legal entity will process the data, and where?
• Which subcontractors are used, and where?
• Which transfer mechanism will be used, and who completes the transfer risk assessment?
• Current SOC 2, ISO 27001 and PCI DSS evidence, with scope.
• Data retention and deletion approach.
• Breach history and notification process.
• Business continuity and disaster recovery test results.