The consequences of non-compliance with POPIA and disclosure of patient information, confidentiality, privacy, and dignity within the South African Constitution.

INTRODUCTION

 Information relating to a person’s health and health care is generally considered to be very personal and confidential.[1] The failure to ensure necessary precisions and the invasion towards privacy could have tremendous and negative implications whereby this could lead to an aggrieved party seeking legal action to even bring a law suit or sue against someone or even against an institution who unlawfully invades upon his or her private affairs, who discloses his/ her private information, and publicises him/her in a false image or appropriates his/her name for personal attention.[2] This is why it is of critical importance to know when to disclose confidential information relating to patients, and this should be kept a priority for healthcare institutions.  Without proper consent, permission, or precautions, the disclosure of protected health information may have far-reaching risks and consequences. In this legal article, we will delve into the consequences of non-compliance with the Protection of Personal Information Act and disclosure of patient information in relation to privacy and dignity within the framework of the South African Constitution. In South Africa, there are various pieces of legislation that apply, and as citizens, we have rights embodied in the Constitution. The Constitution can be described as the supreme law governing the country, whereby any law or conduct inconsistent with the Constitution will be declared invalid.

1. The Background of Legal Foundations of Informed Consent in South Africa

According to the Constitution of the Republic of South Africa 1996, there are sections in the constitution which give rise to our rights as citizens and are as follows[3]:

• Section 9 whereby this provides that everyone has equal protection and equal benefit under the law.
• Section 10, states that everyone has a right to dignity.
• Section 12(2)(b) protects individuals right to bodily and psychological integrity, including the right to make decisions about medical treatment.
• Section 14 stipulates that everyone has the right to privacy, which the right of privacy includes the right against the unlawful collection, retention, dissemination, and use of personal information.
• Section 27 provides that everyone has a right to access health care services.
• And lastly, section 32, which provides for the right to access information held by public or private bodies to give effect to patient’s rights.

2. The Statutory Frameworks

What is POPIA

• The Protection of Personal Information Act, also known as POPIA, seeks to protect natural and juristic persons from harm by securing their personal information.[4] According to South Africa’s main data privacy law, POPIA, specifically Act 4 of 2013, it is considered the act that applies to all organizations that process personal information within South Africa.[5] Non-compliance with the Protection of Personal Information Act (POPIA) in South Africa could result in severe detrimental effects that could be detrimental to both businesses and individuals. The consequences will be revealed in more detail in this article.
• The National Health Act 61 of 2003 provides that a health worker or any health care provider who may have access towards the health records of a user may disclose such personal information to any health care provider or any person as is necessary legitimate purpose within the ordinary course and scope of his or her duties whereby such access or disclosure is in the interests of user.[6] This act provides that it is an offence to disclose patient information without consent, except in certain circumstances. Disclosure is not allowed to occur unless under the following circumstances:
• The patient/user agrees to that disclosure, and it is in writing.
• A court order/specific law, or
• A non-disclosure of the information poses a serious threat to public health.
• It is important to note that the Promotion of Access to Information Act 2 of 2000 (PAIA) sets out various limits on the right to access information.[7] These limitations are designed to protect a person’s right to privacy and commercial confidentiality and to ensure effective governance while balancing this right with other rights outlined in the Bill of Rights.

3. Confidentiality and Privacy within the Healthcare Sector

Confidentiality is also related with the right to privacy, which is a protected human right under our Constitution (section 14).

Confidentiality is also known to be a very important aspect, especially in health care facilities, as essentially for healthcare providers and institutions, adhering to informed consent requirements is both a legal obligation and a critical element of fostering and developing patient trust. Confidentiality can be described as the fundamental right that all patients have. Confidentiality is enshrined in the National Health Act 2003, which states that it is an irregularity to disclose patients’ information without consent. As noted at the beginning of the article, this right provides and means more than simply refraining from disclosing information.[8] This is where it involves you being responsible for ensuring and maintaining all records and patient information are to be kept securely. Patients trust that their medical discussions will remain private and that healthcare providers will take mandatory steps to secure their personal information.[9]  It can be mentioned that patients often approach their trusted health-care practitioners with the utmost confidence that their personal affairs will be kept private and generally, and it is illegal to disclose anyone’s medical information without his/her knowledge.[10]

It is also very important to treat the patient’s privacy and personal information with due care and diligence as this shows respect towards privacy and is also a prerequisite for building trust. Privacy can be regarded as an aspect of an individual’s personality.[11] Essentially, in South Africa, privacy and data protection in healthcare aren’t just legal requirements; they are promises, made and kept, to ensure patient trust in a digital age whereby data flows very quickly. [12]As mentioned in section 14, everyone has the right to privacy which applies to patients as well. South Africa’s healthcare privacy laws are designed to place the patient at the heart of the process.[13] They remind us that healthcare is more about providing care and nurturing trust. Dignity also plays a pivotal role in this, as by adopting a stance that champions privacy as a human right, South Africa is not merely protecting data; it’s also protecting dignity.

4. Case Law Analysis

Case laws such as the De Jagtar v Netcare[14] Limited are known as significant landmark case laws whereby this case had involved patient informational privacy whereby Netcare had encountered a setback which centred around a privacy case involving one of its patients. Heard by the High Court of South Africa, Gauteng Division, the case centred around the plaintiff Nicolas De Jagter raised concerns about privacy violations following the collection of his photos and videos via surveillance, arguing that this was done without his consent or knowledge.[15]  The facts of the case stated that De Jagtar went blind in one eye following a surgery whereby Nicolas had claimed damages of approximately 25 million against Netcare, which involved the unsuccessful surgery. Accordingly, in this case, the problem had centred on whether the surveillance, conducted without De Jager’s knowledge, which led to the violation of his constitutional right to privacy. The plaintiff, Nicolaas J de Jager, had accused Netcare Limited of violating his privacy.

Conclusively, it was held by the court that the surveillance was obtained through footage in a public setting, therefore limiting the invasion of privacy, and established that there was a sufficient link between obtaining the surveillance and the need to provide evidence of De Jager’s true condition. The case of De Jager v Netcare Limited highlighted the critical need for companies and health care institutions to continuously review and refine privacy policies and procedures to ensure compliance with the legal standards. Organizations need to try strengthening the way they handle privacy to ensure responsible collection, use, and storage of sensitive information.

Similarly, in another landmark case of Jansen Van Vuureen v Kruger, the plaintiff, known as (McGeary) who was informed by his general medical practitioner (Kruger) that he was HIV-positive on 10 March 1990.[16] The day after letting McGeary know of his HIV-positive status, Kruger revealed the information to two medical colleagues while on the golf course after a request by the patient to keep the information confidential from other healthcare practitioners. McGeary later then took legal action and sued Kruger for breach of confidentiality that led to invasion of his privacy. This case signified the sense of importance of how it is to maintain confidentiality about a patient and of how important it is to protect the privacy of patients.

And the last case involved NM and Others v Smith, whereby it was showcased and revealed that no permission was given by the applicants before publishing their names in a book.[17] The applicants in the N v Smith had their names included in a book by Ms Patricia de Lille in which their details in particular were revealed in her biography, and the applicants had claimed that their rights  were violated as they had contended before the Court that the publication of their names had  disclosed their HIV status which was a violation of their right to privacy, dignity, and psychological integrity. It was held that disclosure could be made only in a compelling public interest.

5. The consequences of non-compliance with POPIA and disclosure of patient information

 The non-compliance with POPIA isn’t just a misstep, but it is also an expensive one. This would constitute a breach of the POPIA, whereby the consequences of non-compliance with POPIA include[18]:

• Financially
• Reputationally
• And even criminally

Financially: The failure to complying with the Protection of Personal Information Act could result in some financial repercussions whereby information regulators can issue administrative fines which could be up to 10 million from affected patients.[19]These fines can be imposed without needing a court ruling, making them an immediate and severe consequence of non-compliance.

Reputationally: Reputationally, it could essentially affect the business and risk business relationships, whereby public trust is precious and once it becomes broken, it can take some time to regain, whereby the public may not trust the business anymore and would not want to contend or do business with the company. Businesses could lose potential clients and customers, service providers, and potentially other stakeholders.[20]

Criminally: Criminal penalties are more severe, as essentially this could result in serious offences, and responsible individuals could be liable for facing personal liability and imprisonment for up to 10 years. This could therefore lead to consequences that could be detrimental to careers, life. and even cast a shadow upon the company’s leadership.[21]

Operational Disruption: Operational Disruption is when a business may be found to be non-compliant. Essentially it would involve the Information Regulator conducting and issuing enforcement notices whereby these notices would require businesses to take corrective measures, which would essentially lead to the disruption of the regular business operations.

Information Scrutiny: Whereby this could involve the information regulator actively conducting and monitoring compliance and issuing fines for non-compliance. [22]

6. RECOMMENDATIONS

In overall the consequences are multifaceted which could range from financial strain, imprisonment and reputational damage and operational disruption whereby businesses and companies and even healthcare facilities need to ensure and take proactive steps and ensure compliance with POPIA standards are taken into consideration to minimise these severe repercussions from happening in future. This could be done by conducting regular audits, reviewing data protection policies and ensuring continuous monitoring and training. Other recommendations may include health practitioner’s ensuring that they strengthen encryption by ensuring that they implement strong encryption measures to help sustain and protect health data and by implementing stronger and stricter access controls[23]. They may also implement more stricter penalties for those found guilty of non-compliance with POPIA and those found to have disclosed personal and patient information to other parties without consent from patients. They may also grant data access strictly to authorized personnel based on roles and responsibilities. In respect of reviewing data protection policies, they may also develop clear data retention policies and guidelines in which may align with legal requirements and medical best practices. And as mentioned they may conduct regular audits to essentially help identify any gaps and detect any irregularities and abnormalities or unauthorized activities. And lastly with training they may try to educate those who may not be familiar with data security protocols, and some may learn and better understand maintaining patient privacy.

CONCLUSION

In conclusion this legal article has examined the importance of the need that we need to take patient consent for disclosing information seriously and how crucial it is to respect privacy and autonomy. Health care practitioners need to ensure patients understand the reasons and consequences of disclosure. In this ever-changing world, it is very important to adhere to legal obligations under the data protection law, specifically the POPIA. By the implementation of security measures, managing electronic health records with care, this may foster a culture of data privacy of health care institutions within South Africa whereby this can ensure that the patient trust is respected and that sensitive information remains protected and will ensure a healthcare ecosystem in which can strive and thrive within a digitally driven world. Through the demonstration of case laws and applicable legislation this legal article has demonstrated and highlighted the key importance of safeguarding and preserving patient information, confidentiality, privacy, and dignity within South Africa in an such everchanging society.          

BIBLIOGRAPHY

LEGISLATION

1. Constitution of the Republic of South Africa, 1996.
2. National Health Act 61 of 2003.
3. Promotion of Access to Information Act 2 of 2000.
4. Protection of Personal Information Act 4 of 2013.

JOURNAL ARTICLES

5. Unathi Nxokweni, “Protection of Informational Privacy in the Workplace given the advancement in Technology”, 2024, 199-208.

CASE LAW

6. De Jagter v Netcare Limited.
7. Jansen van Vuuren NNO v Kruger 1993(4) SA 842(A).
8. NM and Others v Smith and Other 2007(SA) 250(CC).

INTERNET SOURCES

9. Adams “Privacy and data protection in healthcare in South Africa”, 2024, available https://itlawco.com/privacy-and-data-protection-in-healthcare-in-south-africa/(accessed 2026/06/26).
10. Blc Attorneys “POPIA in 2025”, available https://www.blcattorneys.co.za/2025/02/25/popia-compliance-2025/ (Accessed 2026/06/27).
11. Jean “Disclosure of medical information” 2021, available at https://www.golegal.co.za/medical-confidential-information/ (Accessed 2026/06/26).
12. Juta POPIA Portal “Consequences of non-compliance with POPIA Act” 41 2024, available: https://cms.juta.co.za/popi/popi-news-updates/consequences-of-non-compliance-with-popia/(Accessed 2026/06/26).
13. Kent Cenas “The Risks and Consequences of Disclosing Confidential Information” https://www.ifaxapp.com/hipaa/disclosing-confidential-information(Accessed 2026/06/26).
14. Legal Wise “The right to privacy and access to medical information” available https://www.legalwise.co.za/help-yourself/legal-articles/right-privacy-and-access-medical-information (Accessed 2026/06/26).
15. Legallese “What are the Consequences of Non-Compliance with POPI Act” available at https://legalese.co.za/what-are-the-consequences-of-non-compliance-with-popi-act/ (Accessed 2026/06/27).
16. Munga and Raath “Privacy, Surveillance, and Legal Rights: De Jager v Netcare Limited” (2025), available at https://www.ensafrica.com/news/detail/9726/privacy-surveillance-and-legal-rights-de-jage (Accessed 2026/06/27).
17. Victoria POPIA “Compliance Consequences in South Africa” 2025, available https://cybergl.com/za/blog/popia-compliance-consequences-in-south-africa/(Accessed 2026/06/27).
18. Xpedient “POPIA Compliance for Medical Practices in South Africa: Why It Matters” 2026, available at https://xpedient.co.za/news/popia-compliance-for-medical-practices-in-south-africa-why-it-matters/(Accessed 2026/06/26).

[1] Jean “Disclosure of medical information” 2021, available at https://www.golegal.co.za/medical-confidential-information/>accessed 26 June 2026).

[2] Jean “Disclosure of medical information” 2021, available at https://www.mondaq.com/southafrica/healthcare/1105098/disclosure-of-medical-information/>accessed 26 June 2026).

[3] Constitution of the Republic of South Africa, 1996.

[4] Xpedient “POPIA Compliance for Medical Practices in South Africa: Why It Matters” 2026 available at https://xpedient.co.za/news/popia-compliance-for-medical-practices-in-south-africa-why-it-matters//>accessed 26 June 2026.

[5] Protection of Personal Information Act 4 of 2013.

[6] National Health Act 61 of 2003.

[7] Promotion of Access to Information Act 2 of 2000.

[8] Legal Wise “The right to privacy and access to medical information” available https://www.legalwise.co.za/help-yourself/legal-articles/right-privacy-and-access-medical-information/>accessed 26 June 2026.

[9] Kent Cenas “The Risks and Consequences of Disclosing Confidential Information” <:https://www.ifaxapp.com/hipaa/disclosing-confidential-information//>accessed 26 June 2026.

[10] Legal Wise “The right to privacy and access to medical information”: (n8)

[11] U Nxokweni “Protection of Informational Privacy in the Workplace Given the Advancement in

Technology:”2024 Obiter 199–208.

[12] Adams “Privacy and data protection in healthcare in South Africa 2024 available <https://itlawco.com/privacy-and-data-protection-in-healthcare-in-south-africa/>accessed 26 June 2026.

[13] Adams “Privacy and data protection in healthcare in South Africa”: (n12)

[14] De Jagtar v Netcare Limited.

[15] Munga and Raath “Privacy, Surveillance, and Legal Rights: De Jager v Netcare Limited” :(2025) available at <https://www.ensafrica.com/news/detail/9726/privacy-surveillance-and-legal-rights-de-jage/>accessed 27 June 2026.

[16] Jansen van Vuuren NNO v Kruger 1993(4) SA 842(A).

[17] NM and Others v Smith and Other 2007(SA) 250(CC).

[18] Juta POPIA Portal “Consequences of non-compliance with POPIA Act” (41)2024.

[19] Legallese “What Are the Consequences of Non-Compliance with POPI Act”: available at https://legalese.co.za/what-are-the-consequences-of-non-compliance-with-popi-act/>accessed 27 June 2026.

[20] Legalese “What are the consequences of non-compliance with POPIA” (n19).

[21] Victoria “POPIA Compliance Consequences in South Africa 2025”: available https://cybergl.com/za/blog/popia-compliance-consequences-in-south-africa/> accessed 27 June 2026.

[22] Juta POPIA Portal “Consequences of non-compliance with POPIA act”: (n18).

[23] Blc Attorneys “POPIA in 2025”: available https://www.blcattorneys.co.za/2025/02/25/popia-compliance-2025/>accessed 27 June 2026.