POPIA: Handling historical records with personal information

Discussion
72
Aisha Mbeki
Feb 23, 2026 11:18 AM

We have a collection of apartheid-era records that contain extensive personal information — names, addresses, political affiliations, medical records. Under POPIA, how should we handle access to these records?

The National Archives Act says records over 25 years old are generally accessible, but POPIA seems to create additional obligations. Has anyone navigated this intersection?

We are using Heratio's Privacy plugin but want to hear how others are approaching this.

popia privacy historical-records south-africa

2 Replies

Johan Pieterse Feb 24, 2026 11:18 AM

This is a common challenge in South Africa. The Information Regulator has clarified that the NAA's 25-year rule applies for public records, but POPIA still requires you to consider whether access could cause harm to living individuals.

Our recommendation:

  1. Apply POPIA's "legitimate interest" justification for historical research access
  2. Redact or restrict records containing sensitive health or political information about living persons
  3. Use Heratio's Privacy plugin to flag records that need review
  4. Document your access decisions in the Security Clearance module
Aisha Mbeki Feb 24, 2026 11:18 AM

Thanks Johan — that's very helpful. The Privacy plugin's PII scanning feature is exactly what we need to identify records that require review.