What must we tell parents when we collect consent and take photos?

Section 18 requires the club to take reasonably practicable steps to make sure the data subject knows:

• what information is being collected (for example match photos and video), and the source if it isn't collected from them;
• the club's name and address;
• the purpose (for example the club website, social media, newsletters);
• whether giving the information is voluntary or mandatory, and the consequences of not giving it;
• any law authorising or requiring the collection;
• whether the information will be transferred to another country or international organisation, and the protection it will have there;
• other information needed to make the processing reasonable, such as who will receive it, the right to access and correct it, the right to object, and the right to complain to the Information Regulator, with the Regulator's contact details.

When: before collection if collecting directly, otherwise before or as soon as reasonably practicable after collection (s18(2)). Once told, you don't need to repeat it for later photos collected for the same purpose (s18(3)).

The 2025 regulations add that, when collecting personal information, the club must tell the data subject about their right to object under section 11(3) (regulation 2.4).

Sources: POPIA (Act 4 of 2013) s18; POPIA Regulations as amended in 2025, regulation 2.4.