Legally Enforceable Subpoenas under AHPCSA and Privacy Laws in South Africa

by Adv. Maud Letzler – Head of Legal, Genoa Underwriting Managers

Introduction

1. We consolidate two areas of research: the enforceability of subpoenas issued by the Allied Health Professions Council of South Africa (AHPCSA) and the interplay between privacy laws—especially the Protection of Personal Information Act (POPIA)—and the disclosure of records in litigation.

2. We explain the statutory basis for AHPCSA’s power to issue subpoenas and summarise South African case law dealing with privacy and the disclosure of personal information.

Enforceability of AHPCSA Subpoenas

3. The Allied Health Professions Council of South Africa regulates allied health practitioners. The council’s disciplinary and investigative powers are derived from the Allied Health Professions Act 63 of 1982.

4. Under section 24(5) and section 50(3)(a) of the Act, the council or its professional board may summon any person to appear and give evidence or produce documents relevant to an inquiry.

5. A person who has been duly summoned but refuses to appear, produce documents or answer questions without sufficient cause commits an offence and is liable to a fine. Thus, a subpoena issued by the AHPCSA is backed by statute and is legally enforceable.

6. Failure to comply can result in criminal penalties and, if necessary, the council can ask a magistrates’ court to compel attendance.

Privacy Laws and Disclosure of Records

7. South Africa’s Constitution guarantees a right to privacy, and the Protection of Personal Information Act 4 of 2013 (POPIA) sets conditions for processing personal data.

8. POPIA requires consent for processing personal and special personal information, but it also contains exceptions for legal obligations and litigation.

9. Court rules and other statutes, such as the National Health Act, can override the need for consent when disclosure is required by law.

Divine Inspiration Trading 205 (Pty) Ltd v Gordon & Others (2021)

10. In this case, the plaintiffs in a personal-injury action subpoenaed the defendant’s doctors for her medical records. The defendant argued that disclosure would violate the National Health Act and POPIA.

11. The court held that Rule 38 of the Uniform Rules of Court, which allows subpoenas duces tecum, is ‘law’ for purposes of the National Health Act.

12. Accordingly, medical practitioners must comply with subpoenas even without patient consent.

13. The court examined POPIA and found that section 11(1)(c) allows processing of personal information when it complies with an obligation imposed by law, and section 11(1)(f) permits processing when necessary to pursue a legitimate interest.

14. The court recognised that the doctors were responsible parties under POPIA and that the subpoenas constituted a legal obligation.

15. Sections 12(2)(d)(iii) and 15(3)(c)(iii) further allow the collection and further processing of personal information for court proceedings.

16. The court concluded that POPIA was not intended to conflict with discovery rules and that the patient’s objection must fail.

De Jager v Netcare Ltd & Others (2025)

17. This case involved the admissibility of surveillance photographs obtained by a defendant to disprove the plaintiff’s injury claim. The plaintiff argued that the evidence violated his constitutional right to privacy.

18. The court highlighted the principle of subsidiarity: when a statute such as POPIA exists to give effect to the right to privacy, a litigant must rely on it rather than invoking the Constitution directly.

19. The court held that section 27(1)(b) of POPIA permits processing of special personal information where necessary for the establishment, exercise or defence of a right in law.

20. Because the surveillance evidence was necessary to defend the lawsuit and there was no less intrusive way to obtain it, the court admitted the evidence. It applied POPIA’s minimality principle and ordered that images of children and non-parties be redacted.

Munetsi v Madhuyu (2024)

21. In Munetsi v Madhuyu, the applicant sought an interdict preventing the respondents from posting his cell phone number and defamatory comments on social media. The court held that publishing the applicant’s personal information without a lawful basis breached POPIA and the common-law right to privacy.

22. The court ordered the respondents to remove the posts and refrain from publishing the applicant’s personal information without his consent. This case illustrates how POPIA can be used to protect privacy outside the context of subpoenas.

Conclusion

23. Subpoenas issued by the AHPCSA are legally enforceable because the Allied Health Professions Act expressly empowers the council and its professional boards to summon witnesses and compel the production of documents. Failure to comply can result in criminal penalties.

24. Privacy laws, including POPIA and the National Health Act, do not override such subpoenas; instead, POPIA contains exceptions that allow processing of personal information when required by law or necessary for litigation.

25. South African case law, particularly Divine Inspiration Trading v Gordon and De Jager v Netcare, confirms that POPIA was not intended to conflict with rules of discovery.

26. When disclosure is required by law, privacy concerns may still be managed through redaction and the minimality principle.

Bibliography

1. Allied Health Professions Act 63 of 1982

2. De Jager v Netcare Limited and Others (2025) ZAGPPHC 141 – SAFLII

3. Divine Inspiration Trading 205 (Pty) Ltd v Gordon and Others (2021) ZAWCHC 38 – SAFLII

4. “POPIA face-off on Facebook: High Court says social media post is unlawful, orders interdict” – Werksmans

5. Information Regulator v Minister of Basic Education and Others (2025) – SAFLII