New Health Data Regulations Are Now in Effect — Here's What Your Business Needs to Know

South Africa has new rules for how health information must be handled and they came into force on 6 March 2026. The Regulations Relating to the Processing of Data Subjects' Health Information by Certain Responsible Parties, 2026 were published in Government Gazette No. 54268 and were signed by Adv Pansy Tlakula, Chairperson of the Information Regulator, on 27 February 2026.

Why Do These Regulations Exist?

The primary purpose of the regulations is to assist responsible parties to interpret section 32(6) of POPIA correctly, provide better transparency to data subjects on how their health information may be used, and provide a framework to the Information Regulator for enforcing the processing of health information.

Does This Apply to You?

The regulations apply to the processing of health information by insurance companies, medical schemes, medical scheme administrators, managed healthcare organisations, administrative bodies, pension funds, employers, and institutions working for employers, administrative bodies, or pension funds.

The definition of "employer" is broad. An employer means a person, company, or organisation that pays others to work for them, often under their direction, in exchange for wages or a salary, forming a contractual relationship for work. If that describes your business, these regulations apply to you.

What Is "Health Information"?

Health information means personal information relating to the physical and/or mental health of a data subject, including the provision of healthcare services and/or any testing, treatment, and diagnosis which reveals information about the data subject's health status.

Important: It's Not Just Health Information

This is a point many businesses miss. A responsible party may not process personal information concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, or biometric information of a data subject — unless permitted under section 27 of POPIA. If your business handles any of these categories of employee information, you need to take note.

What Safeguards Must You Put in Place?

The responsible party that processes health information must maintain the confidentiality, integrity, and availability of such information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent loss of or damage to, or unauthorised destruction of health information, and unlawful access to or processing of health information.

In practice, this means your safeguards must specifically cover:

• Physical and electronic records — measures must address the risks associated with physical or electronic health records
• Proper disposal — health records must be properly disposed of to prevent any reasonably anticipated unauthorised use or disclosure of the health information or unauthorised access following its disposal
• Confidentiality obligations — processing of health information must be undertaken subject to a duty of confidentiality imposed by law, office, employment, profession, or written agreement
• Industry-standard security — responsible parties must implement and maintain appropriate and reasonable technical and organisational measures to ensure the integrity and confidentiality of health information, in line with generally accepted information security practices applicable to their sector or industry

What About Sending Health Data Overseas?

The responsible party is prohibited from transferring the health information of a data subject to a third party in a foreign country unless one or more of the requirements set out in section 72(1) of the Act are met. This is a prohibition, not just a guideline — make sure any international data transfers are properly authorised.

Bottom Line

These regulations carry real enforcement weight. The Information Regulator has the authority to act if your business is not compliant. Now is the time to review how your organisation collects, stores, uses, and disposes of health and other sensitive information.

Need help understanding what these regulations mean for your business? Contact the Lawbella team today.