The Protection of Personal Information Act (POPIA) [No.4 of 2013] is the first comprehen-sive data protection regulation to be passed inSouth Africa and it gives effect to the right to informational privacy derived from the constitutional right to privacy. It is due to come into force in 2020, and seeks toregulate the processing of personal informationin South Africa, regulate the flow of personal information across South Africa’s borders, and ensure that any limitations on the right to privacyare justified and aimed at protecting other im-portant rights and interests. Although it was not drafted with health researchin mind, POPIA will have an impact on the sharing of health data for research, in particularbiorepositories. It is now timely to consider the impact of POPIA on biorepositories, and the necessary changes totheir access and sharing arrangements prior to POPIA coming into force.