An Information Certificate can be defined from three angles, each accurate on its own terms. Technically, it is a cryptographically signed trust object certifying the lawful relationship between information, parties and authorised actions. As a governance tool, it is a record that provides visibility, accountability and governance over the use of personal information. To the person the information is about, it is a transparent record of who holds their information, what information, why, for how long, and what control they retain over it.
What distinguishes it from a data record
An Information Certificate does not contain the sensitive personal information itself. It certifies the relationship around that information: which organisation holds it, which categories of information are involved, which actions are permitted (storage, processing, communication), the validity period, and the controls available to the person the information concerns.
Two different relationships it can certify
Not every certified relationship starts the same way. In some cases, a person is asked to approve a new relationship before it exists — a marketing opt-in, for example. In others, the relationship already exists, established by a contract, a legal obligation or another lawful basis — a bank account, an employment contract, an insurance policy, a SIM registration. In that second, more common case, the certificate does not create the relationship; it certifies, governs and makes an already-existing relationship visible to the person it concerns, rather than asking them to approve something that has already lawfully begun.
Why this matters for governance
Under data protection law generally — and POPIA specifically in South Africa — consent is only one lawful basis for processing personal information, alongside contractual necessity, legal obligation, legitimate interest and vital interests. Most personal information in the economy is already held under one of the non-consent bases. An Information Certificate gives that relationship a governed, auditable, person-visible form regardless of which lawful basis it rests on.