Media Officer's Guide to POPIA Photos at Junior Sport Under 18 2025

In almost all cases, yes: the prior consent of a parent or guardian.

Section 34 of POPIA prohibits processing personal information of a child (anyone under 18). Section 35(1) lists the only general exceptions. Processing is allowed if it is:

1. carried out with the prior consent of a competent person;
2. necessary to establish, exercise or defend a right or obligation in law;
3. necessary to comply with an obligation of international public law;
4. for historical, statistical or research purposes that serve a public interest (or where asking for consent is impossible or disproportionate), with sufficient guarantees that the child's privacy is not disproportionately affected; or
5. information the child has deliberately made public with the consent of a competent person.

Posting match photos or highlights on a club website or social media is publishing ("dissemination") and counts as processing (s1). Of the exceptions above, only prior consent of a competent person will normally fit. Without it, the club would need the Information Regulator's authorisation under section 35(2).

Source: POPIA (Act 4 of 2013) ss 1, 34-35.

POPIA says consent for a child's personal information must come from a competent person: "any person who is legally competent to consent to any action or decision being taken in respect of any matter concerning a child" (s1). Under the Children's Act (Act 38 of 2005, s18(3)(c)), a child's guardian (usually a parent) is the person who gives or refuses any consent required by law for the child.

A player under 18 is a "child" under POPIA: a natural person under 18 who is not legally competent to take decisions about themselves without the assistance of a competent person (s1). So a 16 or 17-year-old's own agreement is not enough on its own; you need the prior consent of a parent or guardian (s35(1)(a)).

Players' own posts: POPIA also allows processing of information that the child has deliberately made public with the consent of a competent person (s35(1)(e)). The Information Regulator gives the example of a child's information published on social media with a competent person's consent.

Sources: POPIA (Act 4 of 2013) ss 1, 35; Children's Act 38 of 2005 s18; Information Regulator, Guidance Note on Processing of Personal Information of Children (2021).

Under POPIA, consent is "any voluntary, specific and informed expression of will" giving permission for the processing (s1). For a child's information it must also be given before the processing starts (s35(1)(a)).

In practice that means:

• Voluntary: the parent or guardian must have a real choice.
• Specific: it covers the uses you name (for example the club website and social media), not any future use.
• Informed: the parent knows what will be collected and why, as section 18 requires.

In writing? POPIA does not prescribe a form for consent. But the club bears the burden of proving that consent was given (s11(2)(a)), so keep a record of each consent: who gave it, for which child, which uses, and when.

Consent can be withdrawn at any time; this doesn't make earlier processing unlawful (s11(2)(b)).

Source: POPIA (Act 4 of 2013) ss 1, 11, 18, 35.

Section 18 requires the club to take reasonably practicable steps to make sure the data subject knows:

• what information is being collected (for example match photos and video), and the source if it isn't collected from them;
• the club's name and address;
• the purpose (for example the club website, social media, newsletters);
• whether giving the information is voluntary or mandatory, and the consequences of not giving it;
• any law authorising or requiring the collection;
• whether the information will be transferred to another country or international organisation, and the protection it will have there;
• other information needed to make the processing reasonable, such as who will receive it, the right to access and correct it, the right to object, and the right to complain to the Information Regulator, with the Regulator's contact details.

When: before collection if collecting directly, otherwise before or as soon as reasonably practicable after collection (s18(2)). Once told, you don't need to repeat it for later photos collected for the same purpose (s18(3)).

The 2025 regulations add that, when collecting personal information, the club must tell the data subject about their right to object under section 11(3) (regulation 2.4).

Sources: POPIA (Act 4 of 2013) s18; POPIA Regulations as amended in 2025, regulation 2.4.

Only if the new use is compatible with the purpose the photos were collected for, or another exception applies.

• Photos must be collected for a specific, explicitly defined and lawful purpose related to the club's activities (s13(1)).
• Further processing must be in accordance or compatible with that purpose (s15(1)). To judge this, the club must consider the link between the old and new purposes, the nature of the information, the consequences for the child, how the photos were collected, and any contractual rights (s15(2)).
• The new use is not incompatible if a competent person (parent or guardian) consents to it (s15(3)(a)).

Because the photos are of children, the new use also needs its own section 35(1) ground, normally the prior consent of a competent person (s34-35). If the original consent covered only club match reports, ask parents again before using the photos in a sponsor's advert or on fundraising material.

Source: POPIA (Act 4 of 2013) ss 13, 15, 34-35.

Withdrawing consent: a competent person may withdraw consent at any time (s11(2)(b)). Processing done before the withdrawal stays lawful, but where consent was the club's basis for using the child's photos, it has no consent for using them from then on. Without consent or another section 35(1) ground, section 34 prohibits processing a child's personal information.

Requests to delete: a data subject can ask the club to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or to destroy a record it is no longer authorised to keep (s24(1)). Under the 2025 regulations:

• the request is free of charge, on a form substantially similar to Form 2, and can be made by hand, fax, post, email, SMS, WhatsApp or any other convenient way;
• a request made by phone must be recorded, and the recording (or a transcript) given free on request;
• the club must act as soon as reasonably practicable: correct, delete or destroy the information, or give credible evidence supporting it (s24(2));
• the club must tell the person in writing what it did; the regulations set a 30-day period for this notice.

Objections: where processing relies on section 11(1)(d)-(f) (protecting the data subject's legitimate interest, a public body's public law duty, or the legitimate interests of the club or a third party), a data subject may object on reasonable grounds relating to their particular situation, unless legislation provides for the processing. The objection is free of charge, on a form substantially similar to Form 1. Once an objection is made, the club may no longer process that information (s11(3)-(4)).

Sources: POPIA (Act 4 of 2013) ss 11, 24, 34-35; POPIA Regulations as amended in 2025, regulations 2-3.

No longer than is necessary for the purpose you collected them for (s14(1)), unless:

• a law requires or authorises keeping them;
• the club reasonably needs them for lawful purposes related to its functions or activities;
• a contract between the parties requires it; or
• a competent person (parent or guardian) has consented to the club keeping them.

Photos may be kept longer for historical, statistical or research purposes (for example a club archive) if the club has appropriate safeguards against them being used for anything else (s14(2)).

Once the club is no longer authorised to keep them, it must destroy, delete or de-identify them as soon as reasonably practicable, in a way that prevents them being reconstructed (s14(4)-(5)). A data subject can also ask for a record the club is no longer authorised to keep to be destroyed or deleted (s24(1)(b)).

Source: POPIA (Act 4 of 2013) ss 14, 24.

Security (s19): the club must take appropriate, reasonable technical and organisational measures to prevent loss, damage or unauthorised destruction of photos, and unlawful access to them. That means it must:

• identify reasonably foreseeable internal and external risks (for example shared passwords on the club's social media or photo storage);
• put appropriate safeguards in place against those risks;
• regularly check the safeguards are working; and
• update them as new risks appear.

Security compromise (s22): if there are reasonable grounds to believe someone unauthorised has accessed or acquired the personal information (a hacked account, a lost unlocked phone with player photos), the club must notify:

• the Information Regulator; and
• the affected data subjects (for children, in practice their parents or guardians), unless their identity can't be established.

Notice must be given as soon as reasonably possible, in writing (by post, email, a prominent notice on the club's website, the news media, or as the Regulator directs). It must describe the possible consequences, what the club is doing about it, what the recipient can do to protect themselves, and, if known, who accessed the information.

Source: POPIA (Act 4 of 2013) ss 19, 22.

• Parents and spectators: POPIA does not apply to processing "in the course of a purely personal or household activity" (s6(1)(a)). A parent photographing their own child for the family album is outside the Act. The exclusion covers only purely personal or household use; it does not cover the club's own photos, website or social media accounts.
• News media: POPIA does not apply to processing solely for journalistic, literary or artistic expression, to the extent that the exclusion is needed to balance privacy with freedom of expression in the public interest (s7(1)). Where a journalist is bound by a code of ethics with adequate safeguards for personal information, that code applies instead of POPIA, and complaints are dealt with under the code (s7(2)).

The club's own match photos, team sheets and posts are not journalism or household use, so the full Act, including the rules on children's information in sections 34 and 35, applies to them.

Source: POPIA (Act 4 of 2013) ss 6-7, 34-35.

Not if the processing fits one of the exceptions in section 35(1), most commonly the prior consent of a competent person (a parent or guardian). When an exception applies, the section 34 prohibition does not apply, so no authorisation is needed.

Authorisation under section 35(2) is for a responsible party that wants to process children's personal information without one of those grounds. The Regulator may grant it by notice in the Gazette only if the processing is in the public interest and appropriate safeguards are in place. It can attach conditions, such as letting a competent person review the information and refuse further processing, giving notice of what is processed and how, and not encouraging a child to disclose more than is reasonably necessary.

The Regulator's 2021 Guidance Note on Processing of Personal Information of Children sets out the application process. Applications are made on the form in the guidance note and emailed to authorisationIR.PIC@justice.gov.za (post and hand delivery are also accepted).

Sources: POPIA (Act 4 of 2013) ss 34-35; Information Regulator, Guidance Note on Processing of Personal Information of Children (2021).

• Responsible party: the body that decides why and how the photos are processed (usually the club or school, not the individual volunteer) is the "responsible party". It must make sure all the conditions for lawful processing are met, both when it decides the purpose and throughout the processing (s1, s8).
• Information officer: a private body's information officer is its head, as defined in the Promotion of Access to Information Act. The information officer encourages and ensures compliance, deals with requests made under POPIA, and works with the Regulator on investigations. Information officers may only take up their duties once the body has registered them with the Regulator (s55). Deputy information officers can be designated (s56).
• Operators (hired photographers, media agencies, platforms): someone processing photos for the club under a contract or mandate is an "operator". They may only process the photos with the club's knowledge or authorisation and must keep them confidential (s20). The club must have a written contract requiring the operator to maintain proper security measures, and the operator must tell the club immediately if it believes the photos have been accessed by an unauthorised person (s21).

Source: POPIA (Act 4 of 2013) ss 1, 8, 20, 21, 55, 56.

Breaching any of POPIA's conditions for lawful processing (including posting a child's photo without a lawful basis) is an "interference with the protection of personal information" (s73).

• Complaints: a complaint can be lodged with the Information Regulator in writing (s74, s75). Under the 2025 regulations this can come from the data subject, someone acting for them, anyone with a sufficient personal interest, or anyone acting in the public interest, using Form 5 (online, at the Regulator's offices, or by fax, post, courier or email). The Regulator acknowledges it with a reference number within 14 days.
• Enforcement notice: the Regulator can order the club to take specified steps or stop processing (s95). Failing to comply with an enforcement notice is an offence (s103(1)), punishable by a fine or up to 10 years' imprisonment, or both (s107(a)).
• Administrative fine: for an alleged offence, the Regulator can issue an infringement notice with a fine of up to R10 million (s109).
• Civil claim: the data subject (or the Regulator at their request) can sue for damages, whether or not the club acted intentionally or negligently (s99).

Sources: POPIA (Act 4 of 2013) ss 73-75, 95, 99, 103, 107, 109; POPIA Regulations as amended in 2025, regulation 7.