Section 13 of the Protection of Personal Information Act (POPIA) provide that personal information must be collected for a specific purpose. It reads as follows:
“13. Collection for specific purpose.—
(1) Personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party.
(2) Steps must be taken in accordance with section 18 (1) to ensure that the data subject is aware of the purpose of the collection of the information unless the provisions of section 18 (4) are applicable.”