Consumer Information

Author:  Staff Writer
8 April 2022

Privacy rules to impact estates and complexes in South Africa

Human Settlements minister Mmamoloko Kubayi has reiterated that the introduction of the Protection of Personal Information Act not only applies to businesses in South Africa but also to sectional title and community schemes.

Responding in a recent parliamentary Q&A, Kubayi said the purpose of the Protection of Personal Information Act (POPI) Act, is to protect data subjects from security breaches – such as the unauthorised dissemination of personal information.

“Like most entities, the POPI Act has changed the manner in which the Community Schemes Ombud Service and scheme executives engage with personal information,” she said.

In relation to all community schemes, the eight principles governing the collection, storing, and processing of personal information belonging to members of a community scheme are also applicable, Kubayi said.

“Community Schemes should only collect personal information necessary for the purpose of collection and further put in place measures which protect such personal information belonging to members and their visitors from unauthorised disclosure or theft. Failure to do so will result in the imposition of fines or other enforcement steps taken by the Information Regulator.

“Accordingly, all entities need to invest in the resources they have identified to ensure that the principles of the POPI Act are upheld.”

Kubayi added that the Community Schemes Ombudsman has held training sessions on these changes over the last year, with this information still available to those who need it to comply.

“The POPI Act has not changed the type or nature of information which scheme executives, managing agents or body corporates can obtain from their members.

“The POPI Act has changed the manner, in other words how scheme executives go about collecting, storing and processing their personal information – and, as already mentioned above, all community schemes need to do so in accordance with the principles set out in POPI Act.”

2021 requirement

Community housing schemes were originally given until 30 June 2021 to ensure complete compliance with the Protection of Personal Information (POPI) Act.

The regulations require schemes to have:

  • A POPI policy
  • Amended the rules of the scheme to comply with POPI;
  • An information officer who is the POPI oversight representative of the scheme;
  • POPI agreements with stakeholders who have access to the personal information of owners and tenants.

Schemes that do not have these requirements in place face hefty fines, including fines of up to R10 million or 12 months imprisonment.

The POPI policy should include details of whose personal information is collected and held by the complex including trustees, owners and tenants, as well as visitors. The type of personal information that the complex collects and holds, as well as how the complex collects and stores personal information, must be specified.

The purposes for which the complex collects, uses and discloses personal information must also be detailed, along with information on how an individual may access personal information.

Consideration should also be given to issues such as access control at a guardhouse and CCTV cameras.

The original article and the eight principles can be viewed here: