South Africa needs to consider the development of a national Data Transfer Agreement that integrates both legal and ethical principles for transfers of health research data, including how data will be protected from misuse.