What must I do if a parent withdraws consent or asks for a photo to be removed?

Question

Accepted Answer

Withdrawing consent: a competent person may withdraw consent at any time (s11(2)(b)). Processing done before the withdrawal stays lawful, but where consent was the club's basis for using the child's photos, it has no consent for using them from then on. Without consent or another section 35(1) ground, section 34 prohibits processing a child's personal information. Requests to delete: a data subject can ask the club to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or to destroy a record it is no longer authorised to keep (s24(1)). Under the 2025 regulations: the request is free of charge, on a form substantially similar to Form 2, and can be made by hand, fax, post, email, SMS, WhatsApp or any other convenient way; a request made by phone must be recorded, and the recording (or a transcript) given free on request; the club must act as soon as reasonably practicable: correct, delete or destroy the information, or give credible evidence supporting it (s24(2)); the club must tell the person in writing what it did; the regulations set a 30-day period for this notice. Objections: where processing relies on section 11(1)(d)-(f) (protecting the data subject's legitimate interest, a public body's public law duty, or the legitimate interests of the club or a third party), a data subject may object on reasonable grounds relating to their particular situation, unless legislation provides for the processing. The objection is free of charge, on a form substantially similar to Form 1. Once an objection is made, the club may no longer process that information (s11(3)-(4)). Sources: POPIA (Act 4 of 2013) ss 11, 24, 34-35; POPIA Regulations as amended in 2025, regulations 2-3.