ADVERTORIAL
The Protection of Personal Information Act of 2013 has far-reaching consequences for any organisation that processes personal information, and real estate agencies are no exception. Processing is defined broadly and includes almost any operation involving personal information, while personal information itself covers data relating to an identifiable living natural person or an existing juristic person. To support real estate agencies in meeting their compliance obligations, Cliff Dekker Hofmeyr has developed a POPIA toolkit specifically tailored to the realities, workflows and risks of the real estate sector.
The day-to-day operations of a real estate agency revolve around selling and leasing property under mandate from sellers, landlords and buyers. These activities typically involve collecting, sharing and storing documents, emails and other communications that clearly identify the parties to a transaction. Whether it is correspondence with buyers, engagement with conveyancers or interaction with bond originators negotiating finance with banks, agencies routinely come into contact with personal information.
By merely collecting, transferring or storing this information, an agency is deemed to be processing personal information under POPIA. In most cases, a real estate agency will qualify as a responsible party, meaning it determines the purpose and means of processing personal information and carries a legal obligation to protect the rights of all data subjects involved. This includes sellers, landlords, buyers, tenants, employees, suppliers, banks, bond originators and conveyancers. The POPIA toolkit has been designed to help ensure that these processing activities are lawful and aligned with the eight conditions for lawful processing set out in Chapter 3 of POPIA.
One of the key strengths of the toolkit is its focus on practical guidance. POPIA introduces several complex concepts that can be difficult to interpret in a real-world business environment, and the toolkit assists agencies in navigating these areas with clarity. This includes guidance on special personal information, prior authorisation requirements, record retention and destruction, as well as the registration and designation of information officers.
Special personal information includes sensitive data such as religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, and information relating to criminal offences or proceedings. The toolkit helps real estate agencies identify where such information may exist within their business and explains the implications of processing it, enabling agencies to implement appropriate safeguards.
POPIA also sets out specific processing activities that require prior authorisation from the Information Regulator. These requirements are detailed in section 57 of the Act and can become relevant to real estate agencies in situations such as transferring special personal information outside South Africa to jurisdictions that do not provide adequate protection. The toolkit unpacks these scenarios and explains when and how prior authorisation may be required.
Another critical area addressed by the toolkit is record retention. POPIA requires that personal information not be retained for longer than necessary to fulfil the purpose for which it was collected. In practice, many organisations struggle with record categorisation, ownership and security, resulting in duplicated records, inconsistent safeguards and increased risk exposure. The toolkit provides guidance on implementing effective retention and destruction policies that are both compliant and practical.
The role of the information officer is also given detailed attention. While every public and private body already has a de facto information officer under the Promotion of Access to Information Act of 2000, POPIA significantly expands this role. Information officers now carry additional responsibilities related to data protection and compliance. The toolkit outlines the processes for registration, designation, delegation and appointment of information officers and deputy information officers, and clearly sets out their respective duties so that agencies can assign accountability with confidence.
Cliff Dekker Hofmeyr has developed this real estate agency POPIA toolkit with a strong emphasis on practical implementation rather than theory. It is intended to serve as a solid starting point for any agency embarking on its POPIA compliance journey. With the end of the POPIA grace period imminent, agencies are encouraged to begin their compliance initiatives without delay to reduce risk and demonstrate accountability in their handling of personal information.
