SciELO - Scientific Electronic Library Online

vol.117 issue7-8We object to Bad Science: Poor research practices should be discouraged!Intellectual laziness and academic dishonesty: A threat to academic freedom? author indexsubject indexarticles search
Home Pagealphabetic serial listing  

Services on Demand



Related links

  • On index processCited by Google
  • On index processSimilars in Google


South African Journal of Science

On-line version ISSN 1996-7489
Print version ISSN 0038-2353

S. Afr. j. sci. vol.117 n.7-8 Pretoria Jul./Aug. 2021 



Why POPIA does not apply to DNA



Donrich Thaldar

School of Law, University of KwaZulu-Natal, Durban, South Africa




Keywords: DNA, human biological material, personal information, POPIA, record



One man's trash is another man's treasure. This is especially true with human biological material. While one person may not care much about the fate of a biopsy sample taken from his or her body - and may just be focusing on the diagnosis - another person may see much research potential in the biopsy sample. In particular, geneticists may view the biopsy sample as a 'container' of genetic information. This gives rise to the question: How does our privacy law perceive human biological material? More specifically, does human biological material fall within the ambit of the Protection of Personal Information Act 4 of 2013 (POPIA)? Thaldar and Townsend1 analysed this question and answer it in the negative: POPIA does not apply to human biological material. Adams et al.2 also answer the question in the negative, but express their uncertainty about 'the exact point at which biological samples become personal information'. Where does this leave DNA? In this Commentary, I analyse an important question for genetics researchers, namely whether POPIA applies to DNA.


Conceptual clarity

A good place to start the analysis is to distinguish the nature of biological material from that of genetic information. While biological material is a physical thing, genetic information is something incorporeal. Of course, information can be contained in a physical object, such as a memory stick - or in a string of DNA. However, although a physical thing can contain information, the two are conceptually distinct. In this light, consider the process entailed by genetics research. Typically, the following steps can be identified: (1) the sample is collected from research participants; (2) DNA is extracted from the sample and amplified; (3) the DNA is sequenced; (4) the genetic sequences are analysed, which may include collation with other information, etcetera. The output of step 2 is DNA. Although not visible to the naked eye, DNA is still within the realm of physical objects. In contrast, the output of step 3, namely a sequence of As, Cs, Gs and Ts, is something incorporeal: information. From the perspective of the legal protection of information, step 3 is a consequential step.



POPIA's application provision, section 3, provides that POPIA applies to the processing of personal information that is entered in a record by or for a responsible party. In the following paragraphs, the analysis of whether POPIA applies to DNA is structured around these three italicised phrases, which builds on the analysis by Thaldar and Townsend1.

'Personal information' is defined as information that relates to, inter alia, an identifiable, living, natural person. It includes biometric information, i.e. information that can be used in techniques such as DNA analysis to identify a person. Accordingly, any genetic information contained in DNA that is sufficiently unique to potentially identify a person would qualify as 'personal information'.

Next, it is worth highlighting that the concept 'responsible party' is a technical term in POPIA, which is defined as a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information. In the research context, this would typically be the principal investigator.

The phrase 'entered in a record' is crucial, as it qualifies the circumstances when personal information is regulated by POPIA. The word 'entered' implies a preceding action of entering information. This is important, as genetic information is naturally present in DNA, rather than being entered in such DNA by or for the principal investigator. Accordingly, genetic information that is present in DNA is beyond POPIA's scope of application. As POPIA does not apply to the genetic information that is naturally present in DNA, it follows that POPIA also does not apply to the physical DNA itself. It is only once the DNA has been sequenced and the genetic information has been entered in a record, for instance on a computer, that POPIA applies to the genetic information.

The conclusion that POPIA does not apply to DNA is subject to a caveat: My analysis of 'entered in a record' above is premised on the current state of biotechnology and may change as technology progresses. For example, synthetic DNA may be used as retrievable information storage.3 In such a future scenario in which genetic information is entered in synthetic DNA, rather than naturally occurring in such DNA, POPIA will apply.


Excursus: DNA, computers and the cloud

Some ancillary issues related to the use of information technology in the process of DNA sequencing are worth considering: First, it is important to note that POPIA provides that the action of entering information into a record can be automated. This allows for computer-driven systems that sequence DNA and automatically record the genetic information.

Following on this observation, is the question: Would POPIA still apply if the computer-driven system that sequences DNA does not record the genetic information on any local hard drive, but only somewhere in the cloud (assuming that the cloud servers are not in South Africa)? I suggest the following answer: If the DNA sequencer is in South Africa, the answer would always be affirmative. The reason is as follows: Section 3(1)(b) provides that POPIA applies if the responsible party - i.e. the principal investigator - is domiciled in South Africa or makes use of means in South Africa. (There is an exception, namely where those means are used only to forward information through South Africa; this exception clearly does not apply in the present case.) Therefore, even if the responsible party is not domiciled in South Africa, and the genetic information is saved on the cloud rather than on any device in South Africa, as long as the DNA sequencer - the means - is in South Africa, POPIA will apply.


Concluding remarks

I must express my reservations about the formulation used by Adams et al.2, referring to 'the exact point at which biological samples become personal information' (emphasis added). First, the physical DNA does not become a genetic sequence like a caterpillar that becomes a butterfly. After all, the genetic sequence was present in the DNA all along. Second, attempting to find an exact point may not always accord with contemporary research reality in the biosciences - especially not with genomics. For example, whole-genome sequencing using high-throughput sequencing technology is not an instantaneous event, but rather a gradual digital accumulation of genetic information over a period of hours. As such, thinking in terms of an 'exact point' may not be helpful. The crucial element that brings personal information within the regulatory ambit of POPIA is that it must be entered in a record. Accordingly, it would be conceptually and practically more accurate in the context of contemporary bioscience research to think in terms of the process during which personal information from DNA is entered in a record.

This Commentary's focus on genetic information from DNA should not lull one into thinking that POPIA only becomes applicable to a genetics research project broadly understood at the point of sequencing and digitally recording the genetic sequence. One should remember that there are other types of personal information that may also be relevant. Even prior to the time of biological sample collection, when personal information from research participants is collected as part of informed consent and eligibility screening, POPIA will apply to such information, and will therefore be relevant to a genetics research project. However, the genetic information locked up in a biological sample, and the sample itself - including DNA extracted from it - are all beyond POPIA's scope of application. It is only once the genetic information is sequenced and entered into a record that POPIA applies to it.

Lastly, one should remember that the law is multidimensional, and that POPIA is but one dimension of regulation that may be applicable to genetics research. Accordingly, even though DNA falls beyond POPIA's scope of application, DNA still exists within the broader legal universe that includes inter alia other statutes, case law, and the common law.



I acknowledge support by the South African National Research Foundation (grant no. 116275).


Competing interests

I declare that there are no competing interests.



1. Thaldar D, Townsend B. Exempting health research from the consent provisions of POPIA. PELJ. Forthcoming 2021.         [ Links ]

2. Adams R, Adeleke F, Anderson D, Bawa A, Branson N, Christoffels A, et al. POPIA Code of Conduct for Research. S Afr J Sci. 2021;117(5/6), Art. #10933.        [ Links ]

3. Hoshika S, Leal N, Kim M-J, Kim M-S, Karalkar NB, Kim H-J, et al. Hachimoji DNA and RNA: A genetic system with eight building blocks. Science. 2019;363(6429):884-887.        [ Links ]



Donrich Thaldar

Published: 14 June 2021

Creative Commons License All the contents of this journal, except where otherwise noted, is licensed under a Creative Commons Attribution License