Page 22 - Nexia SAB&T Property and Tax Guide 2025

THE PROTECTION OF PERSONAL INFORMATION ACT

◆ The Protection of Personal Information Act (4 of 2013), otherwise known as POPIA,
promotes the protection of personal information by public and private bodies.
The Information Regulator (IR) is the body responsible for education, monitoring,
enforcement and compliance, as well as the handling of complaints, performing
research and facilitating cross-border co-operation.
◆ Estate agents, intermediaries, property companies and other institutions
conducting business in the property sector, are required to comply with the Act and
its Regulations, which includes obtaining consent from client before any of their
private information is used, and collecting and storing client information in such
a way that only individuals with the necessary authorisation are able to access it.
Neither estate agents nor conveyancers may share a client’s information or pass it
on to another organisation or body without the data subject’s written consent, and
have suitable systems and rules in place so as to properly safeguard the client’s
personal information. Estate agents will also not be allowed to hand over the
information of tenants and interested purchasers to landlords and sellers without
the necessary policies having been set up and permissions obtained. A breach may
expose the holder of the information to a damages claim, and/or prosecution for a
criminal offence – attracting a possible fine or a period of imprisonment, or both.
◆ Estate agents will need to be cognisant of the strict limits imposed by POPIA
relating to direct marketing. They will need to obtain the necessary permissions
in order to continue communications to clients such as sending newsletters and
campaigns, online marketing, bulk emailing, special offers and latest listings.
◆ The POPIA Amendment Regulations were published on 17 April 2025 and took
effect immediately. These Regulations have brought about, inter alia, the expansion
of data subject rights in regard to the processing of their personal information.
◆ The IR is also working on a Guidance Note on direct marketing.

20