The record maintenance obligation imposed on Financial Services Providers in light of the Protection of Personal Information Act 4 of 2013

Abstract

The digitisation of economic and social life has elevated the value of personal information, positioning its governance at the intersection of constitutional and commercial concern. In South Africa, the Protection of Personal Information Act 4 of 2013 gives legislative effect to the constitutional right to privacy by establishing binding principles for the lawful collection, processing and retention of personal data. Yet financial sector statutes, such as the Financial Advisory and Intermediary Services Act 37 of 2002 and the Financial Intelligence Centre Act 38 of 2001, impose extensive recordkeeping obligations on financial services providers to promote transparency, integrity and financial stability. The coexistence of these frameworks generates tension between individual privacy rights and institutional duties, thereby exposing the difficulty of giving simultaneous effect to privacy, accountability and economic integrity within a constitutional democracy. This tension gives rise to the central question of how personal information governance in South African financial institutions can reconcile the Protection of Personal Information Act's privacy protections with sector specific retention obligations. Within this context, sections 14 and 24 of the Protection of Personal Information Act create interpretive space for such harmonisation, complemented by comparative insights drawn from the European Union's General Data Protection Regulation and the jurisprudence on the right to be forgotten. Read together, these frameworks suggest that proportionality can serve as the guiding principle for assessing the necessity, scope and duration of data retention and erasure, enabling financial services providers to mitigate conflict between individual rights and regulatory duties. Proportionality and relational dignity frame recordkeeping and data management as practices of accountability rather than purely administrative functions. Decisions regarding the retention, correction or deletion of personal information reflect broader societal expectations of fairness, transparency and respect for personhood. Ethical and philosophical principles drawn from Kantian autonomy, Rawlsian fairness, Habermasian legitimacy and the African ethic of Ubuntu provide a lens iv through which proportionality can be applied contextually, guiding institutions in interpreting their duties while remaining sensitive to the rights of individuals. From these insights, a model emerges in which proportionality, transparency and relational accountability structure data governance in financial institutions. The model offers practical guidance for determining retention periods, responding to correction or deletion requests and reconciling regulatory compliance with privacy obligations. It demonstrates how institutional memory can be exercised in ways that uphold both legal duties and personal autonomy, translating constitutional values into operational standards that are both principled as well as actionable. Together, these insights advance understanding of how privacy rights and sector specific obligations can coexist in a constitutional democracy. They present a coherent framework for regulatory interpretation that harmonises compliance with ethical and constitutional imperatives. This framework provides financial services providers, regulators and policymakers with a structured approach for navigating competing obligations while maintaining accountability, fairness and transparency in the governance of personal information