Abstract
Globally, there has been a move toward ‘open science’ that includes the sharing of health data for research. The importance of data sharing for research is generally acknowledged, but this must only be done with legal and ethical procedures and protections in place. The use and sharing of health data for research in South Africa has changed with the coming into force of the Protection of Personal Information Act (POPIA). POPIA should ensure greater transparency and accountability in the use of personal information. POPIA, however, adopts a principle-based approach to the regulation of personal information, and there is a lack of clarity and uncertainty in the application of some of these principles to the use of health data for research. POPIA provides for sector-specific responses through the development of codes of conduct. In this article, we discuss the need for a code of conduct for health research, and an approach that could be adopted in its development.