POPIA stands for the Protection of Personal Information Act, Act No. 4 of 2013 or POPI Act.

It is South Africa's data protection law. It establishes a number of minimum requirements that organisations must comply with when dealing with personal information; how they gather it, use it and protect it.

Personal information is any information that can be used to identify a person or a business.

This includes:

  • Identifiers - A name, identity number, staff number, etc. - anything that can be used to identify a person.
  • Access control - User names and passwords
  • Demographic information - race, gender, sex, pregnancy, marital status, or national, ethnic or social origin, colour, sexual orientation, age, etc.
  • Contact details
  • Financial information
  • Background information
  • Biometric information
  • Personal opinions
  • Correspondence

Research activities that involve personally identifiable information of individuals or organisations have to take the POPI Act into consideration.

Considering the impact that research activites have on participants' right to privacy is not just a POPIA obligation, it is also an integral part of research ethics.

  • De-identify when you can
  • Collect as little as possible
  • Be transparent
  • Keep information safe

 

Researchers may request an ethics waiver when a formal ethics review is not considered necessary, but evidence of ethics review is still required. For instance, when submitting to a journal or applying for funding.

The process of requesting an ethics waiver is outlined on the Ethics Waiver page on the REC-H website. 

High risk research poses a real and foreseeable risk of harm or serious adverse consequences to participants and researchers if not managed in a responsible manner.
Medium risk research – research involving vulnerable groups, sensitive or potentially sensitive topics, access to private information, and in which there is a potential risk of harm or discomfort, but where appropriate steps can be taken to mitigate or reduce overall risk.
Low risk research – where the only foreseeable risk is one of inconvenience or discomfort, or where the probability and magnitude of possible harms implied by participation are no greater than those posed by everyday life in a stable society

FORMAL ETHICS REVIEW IS NOT REQUIRED WHEN:

  • the study does not involve humans or use data or biological materials belonging to humans.
  • the research relies exclusively on information that is publicly available (i.e., involves the analysis of information in the public domain) or that is accessible in terms of legislation or regulation, and:
    • does NOT require gatekeeper, site, or platform permission,
    • does NOT involve sensitive or potentially sensitive information,
    • AND uncontroversial topics are being investigated,
    • AND participants are not from vulnerable populations,
    • AND data collection and dissemination of research findings will not identify individuals or groups and does not create the possibility of re-identification.
  • the research involves the observation of people in public spaces (including virtual public spaces) and natural environments, provided that:
    • the researcher does not interact directly with individuals or groups,
    • the researcher does not stage any intervention, the individuals or groups do not have a reasonable expectation of privacy,
    • and dissemination of research findings does not identify individuals or groups and does not create the possibility of re-identification.
  • research that is exclusively for quality assurance, quality improvement (audits), programme evaluation activities, performance reviews, and consumer surveys.
This question on the ethics application form helps reviewers understand the reason for choosing this particular group of people for your study.

 

If you’re a student, refer to the “Importance of the Study” section in your research proposal. Use the key points from that section to explain why this population is important to your research. Be concise and provide a summary rather than copying and pasting directly.

 

NB: Ethics reviewers will use this section to assess whether your study justifies the time and involvement

The research objectives you provide on your ethics application must match exactly with those in your research proposal, permission request letters, and any communication with participants. Consistency is key. If your research objectives aren’t described the same way across these documents, it could appear as though there’s confusion or a lack of focus, which might raise concerns about the integrity of your study.

Your research objectives should be clearly aligned with the sub-questions that your data explain what you plan to do (e.g., explore, assess, or compare) and what kind of results you expect (e.g., identifying patterns, relationships, or key themes). Well-defined objectives help ethics reviewers understand the purpose of your study and how you intend to achieve it.

In your ethics application, provide details about the locations where you will collect your data, including the geographical location (city, region, country) and the type of place (e.g., school, hospital, community centre, online platform).
The target population is the entire group of people or cases that your research is focused on. It’s the group you want to study and draw conclusions about. Make sure on your ethics application that your target population is clearly defined and directly relevant to your research question or objectives.
Sampling strategy indicates how you will select participants from your target population (e.g., random sampling, stratified sampling, convenience sampling). In your ethics application, you will need to justify why this method is the best choice for your study or specific phase of the study. If you plan to use more than one method, explain why each is necessary.

"Inclusion criteria" refers to that set of characteristics that all participants must exhibit so as to be included in the data collection procedure.

You will be required to describe particular characteristics that are required to be present in participants in the target group (e.g. particular age, cultural derivation, background, physical characteristics, disease status, etc.). Unless there are good reasons for the deception, inclusion criteria must be made available in writing at the point of recruitment. Make sure your inclusion criteria is well-defined, justifiable, and aligned with your study objectives.

 

"Exclusion criteria" refers to that set of characteristics that excludes individuals (i.e. those individuals who have been recruited and have indicated a willingness to participate) from participating.

Unless there are good reasons for the deception, exclusion criteria must be made available in writing at the point of recruitment. Make sure your exclusion criteria is well-defined, justifiable, and aligned with your study objectives.

An international cross-border study involves collecting data or conducting research across two or more countries or jurisdictions. For example, interviewing participants who live in different countries, or collecting personal data from residents in another country, counts as cross-border research. However, using publicly available information from websites based in other countries without interacting with people there is usually not considered cross-border.

 

Using publicly available information from websites in other countries is usually not considered cross-border research because it doesn’t involve collecting personal data directly from people in those countries. However, if the data includes personal or sensitive information about individuals, or if local laws protect that data, it may still be subject to that country’s regulations and count as cross-border.

Recruitment refers to the methods you will use to identify and approach individuals to take part in your study. You must describe the full recruitment procedure clearly and step by step, including:

  • WHEN each part of recruitment will happen,
  • WHERE it will happen,
  • BY WHOM, and
  • WITH WHOM.

You must explain:

  • How you will identify potential participants (e.g. through a database, social media group, organisation, etc.).
  • What tools or support you will use to identify them (e.g. records, gatekeepers, third parties).
  • How they will be contacted (e.g. email, in person, flyers, social media), and who will contact them.
  • How participants will be given information about the study before they decide to take part (e.g. via a letter, email, or post).
  • How they can show interest or volunteer (e.g. click a link, email you, complete a form).

You must show:

  • That your recruitment is ethical, POPIA-compliant, and avoids inappropriate use of personal information.
  • How you will obtain permission to recruit (from a gatekeeper or platform admin, if needed).
  • That participants will not being pressured or influenced, especially by people in authority.
  • That your recruitment messages are clear, accurate, and easy to understand, and available in languages where needed.

Attach copies of all emails, posters, messages, or verbal scripts you plan to use in recruitment. Reviewers want to see exactly what potential participants will be told.

Enrolment refers to the process of screening, selecting, and formally including volunteers who have expressed interest in your study. This is different from recruitment in that recruitment is how you find interested volunteers. Enrolment begins after someone shows interest and ends when they are officially included in the study.

Your response must describe:

  • HOW you will assess whether a volunteer meets your inclusion criteria.
  • HOW you will respond to them (e.g. by email or phone) and what you will send them (e.g. consent form, study details, survey link).
  • HOW you will ensure that only eligible and selected individuals are enrolled (especially if more people volunteer than you need).
  • WHO will manage each step of the enrolment process.
  • WHEN and WHERE each step will take place (e.g. during a certain time period, on a secure platform, in-person, etc.).

You must also explain:

  • How volunteers will contact you securely and confidentially.
  • How and when informed consent (or assent, if minors) will be obtained.
  • How you will let people know if they were not selected (if applicable).
  • How you will protect participants' rights and privacy throughout this process.

Enrolment materials must include:

  • The informed consent form and information sheet at all times.
Informed consent is paramount because it respects an individual’s right to self-determination. It ensures participants choose whether to engage in research, based on a complete understanding of the study’s purpose, procedures, potential risks, and benefits. This process allows individuals to exercise control over their involvement, free from coercion or undue influence.

Consent means a participant’s clear agreement to take part in your study, ideally recorded in writing. It is a legal requirement to have informed consent for all participants.

Key points to consider:

  • Consent must be informed, explicit, and voluntary. Participants should clearly understand what they are agreeing to and freely decide whether to participate.
  • Explicit consent means participants actively say “yes” (e.g., signing a form, clicking a yes/no button). Simply completing a survey without clear agreement is not enough.
  • While written consent is preferred, other recorded forms (like oral consent) can be accepted but may be harder to manage and audit. Oral consent recordings should be stored separately and not mixed with study data.
  • Getting permission from a gatekeeper to access participants does not replace obtaining individual consent from each participant.
  • Clearly explain when and how participants will receive the consent form and how you will collect signed forms (e.g., in person, email).
  • Make sure participants know they have the right to refuse or withdraw from the study at any time without penalty.
  • Use official university letterhead and ensure the form is easy to read by avoiding the use of jargon and check grammar carefully.

Consent forms should include:

  • Permission to record interviews or focus groups (if applicable).
  • Assurance of anonymity or confidentiality, including limits (e.g., in focus groups).
  • Contact details for the Principal Investigator (PI) or research team, the university ethics committee, and relevant regulatory bodies.
  • Option to give permission to reuse data for future studies (if relevant).
  • Areas for participant and researcher signatures.
  • Instructions on how participants can raise concerns or complaints, including contact emails for the researcher, supervisor, REC-H (rd@mandela.ac.za), NHREC (nhrec@health.gov.za), and SAHPRA (if applicable).
  • The ethics approval number (to be added after approval).

Download the informed consent template from the Reference Documentation section on the RECH websiteRemember, it is a template you must tailor the content and formatting for your project and remove placeholder text before submitting.

Translation of Consent documents: If your study involves community-based research or participants who may have limited English proficiency (e.g., immigrant populations, international contexts, or multilingual communities), it is important to ensure that all participants clearly understand the study’s purpose, procedures, and any potential risks involved. For this reason, informed consent documents must be translated into the appropriate local language to ensure participants are truly informed before agreeing to take part in the research.

On the REC-H website under the Reference Documentation section.

If the study involves minors, you will need to obtain assent and parental consent.

Assent is the agreement from a person who cannot legally give full consent—usually a child or adolescent under 18. Even though they are not legally able to consent, they still have the right to understand the study and agree to participate.

If your study involves minors or individuals who cannot give legal consent. You must obtain both:

  • Parental or guardian consent, and
  • Assent from the child or participant.

Your assent process must:

  • Use age-appropriate language the participant can understand.
  • Make it clear that participation is voluntary and they can say no.
  • Avoid pressure or coercion from adults, teachers, or caregivers.
  • Be written, where possible, and include a signature line (if appropriate), or be audio-recorded with separate files from the research data.

Your assent form should include:

  • A simple explanation of the study.
  • What the participant will be asked to do.
  • Any discomfort or risks, and any benefits.
  • Their right to stop at any time without consequences.
  • Who they can talk to if they have questions.

If you're unsure whether assent is required, ask yourself: Is this person legally able to give full informed consent? If not, assent is required, alongside a legal guardian’s consent.

Attach both your assent form and parent/guardian consent form with your ethics application.

Translation of Assent documents: If your study involves community-based research or participants who may have limited English proficiency (e.g., immigrant populations, international contexts, or multilingual communities), it is important to ensure that all participants clearly understand the study’s purpose, procedures, and any potential risks involved. For this reason, informed consent documents must be translated into the appropriate local language to ensure participants are truly informed before agreeing to take part in the research.

"Gatekeeper" refers to a person(s) who control(s) access to the participant population. A gatekeeper shall not also fulfil the role of participant recruiter. The gatekeeper should not actively recruit participants.

If you are recruiting people linked to a company, organisation, institution, or community, you almost always need a gatekeeper (that is someone with the authority to give access e.g. manager, department head, community leader).

  • Gatekeepers may share your recruitment info, but due to POPIA, they must not handle responses from participants.
  • Participants should be asked to contact you directly if they’re interested.
  • You must prepare a draft letter of permission, but you can only send it once you have ethics approval (include your REC-H number).

Your draft letter must:

  • Be on the official university letterhead,
  • Clearly explain your study and what you are asking for,
  • Include your contact details, the gatekeeper’s address, and the time commitment for participants,
  • Request permission to access participants and/or premises, if applicable.

 

For a research study involving Nelson Mandela University staff or students that is to be conducted by student or staff of Nrlson Mandela University , the gatekeeper is one or more of the following:

  • DVC: Research, Innovation and Internationalisation (for staff and/or student participants across more than a single faculty);
  • Executive Dean (for student participants from multiple Departments in the same faculty);
  • Head of Department (for student participants from a single Department).

For external researchers, the gatekeeper is:

  • DVC: Research, Innovation and Internationalisation 

The RECH recognises that researchers and students need to develop their studies in collaboration with the target community, population or relevant stakeholders to reduce the exploitation of participants and communities and to ensure that the participating community share the benefits of research as far as possible.

Prior community engagement could assist the researcher with building rapport with the target community or group, and/or negotiate access to participants or confidential databases/archives. This might help the researcher to plan their research more effectively to avoid setback

Prior community engagement refers to any consultation, discussion, or involvement with the community or group that your research focuses on before starting the study. This helps ensure your study is relevant, respectful, and ethically sound.

  • Engagement may include meetings with community leaders, cultural advisors, or representatives of the population group.
  • It shows that the study has community support, helps identify potential risks, and strengthens trust.
  • Even informal engagement like conversations or prior collaboration should be described briefly.

Researchers are cautioned that the purpose of such prior engagement is solely for building rapport and refinement of the research question or aims/objective

Prior community engagement should not be confused with formal recruitment and data collection for the purpose of research. Prior engagement does not equal permission to conduct the study. You still need to obtain ethics approval and formal gatekeeper permission (where applicable) before beginning any data collection.

Researchers must inform participants and stakeholders that formal recruitment and data collection can only start after ethics approval is obtained.

Risk means any possible harm or negative effect on participants beyond what they normally experience in daily life.

Ethics committees carefully weigh these risks against the benefits of the study. You must clearly explain any risks, how likely they are, and how you will reduce them (for example, by keeping participants anonymous).

Being honest about risks shows you respect your participants and strengthens your application.

Incidental findings are unexpected discoveries made during your research that are outside your study’s main focus.

These might be important for participants but can raise ethical or legal issues, like signs of abuse or illegal activities.

You need to explain how you will handle these.

"Benefit" refers to any possible positive effect of any data collection activity on the welfare of a participant over and above what would be expected from such a participant as a result of routine daily tasks.

Direct benefits are any positive effects for participants themselves (e.g. gaining new knowledge, accessing a service). Often, there may be no direct benefit and that’s acceptable if the study is well justified.

Societal or ethical value refers to how your research might help the wider community, improve policy, inform practice, or add to knowledge. Show how your study matters beyond just data collection, it should aim to solve or explore a real-world issue.

And remember that you must (and REC-H will) continuously evaluate the risks and benefits of the study.

If you plan to offer any reimbursement or incentives, clearly justify the reason and explain how the amount is calculated. Include a budget to show that compensation is reasonable and appropriate.

Monetary incentives should be avoided unless absolutely necessary. Compensation is meant to cover costs or inconvenience, not to be seen as a benefit. It may improve participation rates and help ensure a representative sample.

Consider these points:

  • Is the compensation fair and reasonable?
  • What happens if participants do not complete the study?
  • Are participants’ out-of-pocket expenses (e.g., travel, data costs) covered?
  • For minors, who receives the compensation?
  • Could excluding compensation affect participation or study outcomes?

Remember: Offering incentives automatically classifies the study as medium risk and requires additional institutional review.

Anonymity refers to a situation where the data collected contains no identifying information and cannot be linked to any individual participant or group. For instance, an anonymous online survey.

Confidentiality refers to the responsible handling of information that may include personal or identifying details. Where such information is collected, it must be kept secure and only accessed by authorised individuals.

Researchers must comply with applicable data protection laws, such as POPI regulations, and be able to clearly justify why any personal or identifying information is being collected. All data should be stored safely, and identifying details must not be disclosed in reports, publications, or presentations.

It is important to not make any participant identifiable. Never identify participants by name.

Wherever dealing with case studies focusing on a specific company, school, university, organisation, etc. (hereafter referring to all as organisation) avoid using the specific name of the organisation as it may result in a reputational risk to the researcher, university and/or the organisation if inaccurate results are reported or if the results shed an unflattering light on the organisation. This could, in extreme cases, result in legal action. In addition, anonymity would be breached if, for example, you use the name of the employer if there is possibly only a single participant per company.

In compliance with the National Department of Health (NDoH) ethics guidelines (2024), all researchers and their supervisors seeking ethical clearance must produce evidence of ethics training within the previous three years.

There are various online training courses available. These can be found on the REC-H Ethics Training webpage. 

Any ethics training course completed must include an assessment and certification indicating successful completion of the assessment component. Ethics training certificates must be refreshed every three years.

 

No, MEOS training shows you how to use MEOS, how to create an application, navigate through it and submit it for review. 

It does not cover the ethical principles that you need to consider in your research study. 

Please refer to the list of suitable courses on the REC-H Ethics Training webpage. 

The Primary Responsible Person (PRP) of the study should store the data.
All data must be stored securely by the PRP for a minimum of 5 years for validation and audit purposes.

Data must be protected from unauthorised access, loss, or misuse, whether stored physically or digitally.

  • Physical data (e.g. paper forms) should be kept in a locked cabinet in a secure office.
  • Digital data must be stored on a password-protected device or encrypted cloud storage, accessible only to authorized persons
  • Personal or sensitive data must be anonymised or de-identified where possible.

Ensure all data handling complies with POPIA.

Data re-use means using data collected in this study for another research purpose. This generally requires new participant consent and a separate ethics application.

If you plan to re-use data:

  • Be specific about how and why the data will be used again.
  • Participants must give informed consent for this at the outset.
  • You must ensure the data is only used for research, with ethics approval and safeguards in place.

Publishing results from this study does not count as data re-use.