Lake Properties
What Is the POPIA Act in South Africa? A Complete Guide for Home Buyers and Sellers
Why POPIA matters when you buy or sell a house
The Protection of Personal Information Act, known as POPIA, decides what may happen to your ID copy, bank statements and phone number from the moment you hand them to anyone in a property deal.
Buying or selling a house is probably the biggest transaction you will ever sign. Along the way you hand over a surprising amount of private information. An estate agent gets your ID, your proof of address and your contact details. A bank or bond originator gets your payslips and bank statements. A conveyancing attorney gets everything again, plus your marital status and your title deed.
Most people never stop to ask where all of that goes afterwards. Can the agent pass your number to another company? Can photographs of your living room, family portraits included, end up on a property portal? What if an employee emails your ID to the wrong person, or a criminal reads your agent's inbox and uses your details to hijack the transfer payment?
POPIA is the law that answers those questions. The Act is Act 4 of 2013, and its main operational sections came into force on 1 July 2020. Businesses then had a 12-month grace period, which ended on 30 June 2021, so the rules have been fully enforceable for several years now.
This guide is written for ordinary buyers, sellers and owners, not for lawyers. It explains what POPIA actually requires, what your estate agent must do, which rights you can use, and where people tend to get the law wrong. It also covers the other laws that sit beside POPIA in a property deal, because when an agent asks for your ID, POPIA is often not the only reason.
If you are about to sign a mandate, an offer to purchase or a bond application, read this first. And if anything in it raises a question about your own sale or purchase, Lake Properties in Wynberg is happy to talk it through before you put pen to paper.
What exactly is the POPIA Act?
POPIA is South Africa's data protection law: it sets the rules for how any business, organisation or government body may collect, use, store, share and delete the personal information of other people.
It exists to give effect to the constitutional right to privacy. In plain English, an organisation cannot treat your private details as its own property. It needs a lawful reason to hold them, it must collect no more than it needs, it must keep them safe, and it must be open with you about what it is doing. The Information Regulator is the independent body that supervises all of this, takes complaints and can issue enforcement notices.
What counts as personal information in a property deal?
The definition is broad. In a typical sale or purchase it includes:
- Your full name, ID number or passport details
- Your home, work and postal addresses
- Cell numbers, WhatsApp numbers and email addresses
- Payslips, bank statements, tax numbers and proof of income
- Banking details and bond approval documents
- Your marital status and matrimonial property regime
- Your signature and the correspondence around the deal
- Photographs or video in which you, your family or your belongings can be identified
Some information is treated as "special personal information" and gets extra protection, for example health details, religious beliefs, biometric data and information about children. Most property transactions never need it, which is one more reason an agent should not be asking for it.
POPIA also protects existing companies and trusts, not only individuals, so it matters if you buy or sell through a Pty Ltd or a family trust.
One distinction trips people up. A property's asking price, bedroom count and suburb can be advertised freely. The privacy question starts when that information is tied to an identifiable owner together with private contact or financial details.
Who is responsible for protecting your information?
POPIA uses two labels. The organisation that decides why and how your information is used is the responsible party. A service provider that handles information on its behalf is an operator. In a property deal several organisations can be responsible parties at the same time:
- The estate agency, which handles enquiries, mandates, viewings and marketing
- The bank or bond originator, which assesses your finances
- The conveyancing attorney, who manages the transfer and registration
- Any inspector, photographer or compliance certificate provider who receives your details to do a job
Each one carries its own duties. Every business must also have an Information Officer, and that officer must be registered with the Information Regulator before taking up the role.
Before you appoint an agency, ask whether it has a written privacy policy and who deals with privacy questions. A professional agency will answer without hesitation, and if you would like to see how we handle this at Lake Properties, just ask us.
How POPIA affects you as a home buyer
As a buyer, POPIA follows your information through four stages: the first enquiry, the home loan, the offer to purchase and the transfer.
When you enquire about a property
You might contact an agent through a portal, a website form, WhatsApp, Facebook or a phone call. The agent will note your name, number, email and what you are looking for so that they can reply and book a viewing.
That is perfectly fine. What it does not mean is that the agent may use those details for any purpose they like. Your enquiry about one house is a reason to respond about that house. It is not a blanket licence to add you to a mailing list, hand your number to a third party or message you about unrelated products.
Ask what the agent needs, why they need it and whether you will receive marketing beyond your original enquiry. If you only want alerts for three-bedroom homes in Crawford, say so.
When you apply for a home loan
Banks and bond originators ask for the most sensitive documents in the whole process: ID, payslips, bank statements, proof of address and details of your existing debt. POPIA does not stop them. Assessing whether you can afford a bond is a legitimate and legally regulated activity, and they do not need a fresh consent form for every step.
What POPIA does require is that those documents are used for the credit assessment and kept safe. The practical risk for you sits in how the documents travel. A payslip emailed to the wrong address, or sent to a fake "consultant" on WhatsApp, can end up in a fraudster's hands.
Send financial documents only through verified channels, and confirm the recipient's identity by phone first.
When you sign the offer to purchase
The offer to purchase carries your full legal name, ID details, address, marital status, signature and the price. The agent, the seller and the conveyancing attorney all need some of that to complete the deal, and POPIA allows it because the information is necessary to conclude the contract.
What you can do is read any privacy clause before you sign and ask what it covers. Does it only authorise sharing for the transaction, or does it also authorise future marketing? Those are two different things and they should be clearly separated. Our guide to transfer costs and bond costs explains the money side of the same paperwork, so you know what the conveyancer will ask you for and when.
When you attend viewings
Agents normally record your name, number and feedback so that they can manage access and follow up. That is reasonable for safety and for managing the sale. A viewing does not, however, authorise unrelated promotional messages or the passing of your details to other businesses.
Give only what is reasonably needed, and ask how the viewing register is stored.
If you are buying in Cape Town and want a straight answer about how your documents will be handled before you register anywhere, ask us. We would rather you ask early than worry later.
How POPIA affects you as a home seller
Sellers face a different problem to buyers: you want the house marketed widely, but you do not want strangers learning about your finances, your family or the days your home is empty.
Advertising your house online
Your agent will normally advertise on the agency website, the property portals and social media. A good advert shows photographs, the asking price, bedrooms and bathrooms, the suburb, erf and floor size, features like parking or a pool, and the agency's own contact details.
What it does not need is your name, ID number, private cell number or banking details. Those should stay out of anything public.
Before the photographer arrives, walk through the house and look for things that identify you: family portraits, school photos, post on the kitchen counter, a safe left open, a laptop on the desk. Ask to see the final photographs before they go live. A listing should show off the house, not your private life.
Your address and your safety
POPIA is not a blanket ban on publishing where a property is. Buyers need enough location detail to judge a home and book a viewing, and ownership details held at the Deeds Office can be searched in any case. You cannot realistically make the address disappear.
What you can control is the extra detail. An advert that says the owners are overseas, the house is empty or that the contents are valuable creates a security risk for nothing. Ask your agent to keep access arrangements, alarm details and key locations out of public marketing and to share them only with people who are actually viewing.
When a buyer makes an offer
The agent will pass the offer, any bond approval and the proof of funds between the parties and the conveyancing attorney. That is part of the deal. But as the seller you do not automatically need to see every page of the buyer's bank statements or payslips. A bond approval letter or proof of funds is normally enough to judge whether the buyer can proceed.
If a buyer's financial documents are being forwarded around, ask who needs them and why.
After the sale
Once transfer registers, your agent does not need most of your information for day-to-day business any more. That does not mean it must be deleted that day. Legal and tax rules require some records to be kept, including the identity and transaction records an agency must keep under the Financial Intelligence Centre Act, which we explain below. POPIA's own rule is that information should not be kept longer than necessary for the purpose it was collected, unless the law allows or requires otherwise.
What you can do is ask the agency how long it keeps your records and tell it in writing that you do not want marketing messages after the sale.
Selling a house from a deceased estate
If you are an executor or heir selling a property from an estate, you are handling other people's personal information too: the deceased's ID and title deed, the beneficiaries' details, and often their bank details. Share only what the agent and attorney actually need. Our guides on the documents you need to sell a house out of a deceased estate and on the consequences when an executor pays himself too early show why it pays to keep that paperwork tidy and controlled.
You will also want to understand what the buyer and what the seller each pay in a property transfer, because that is when the most documents change hands.
If you are planning to sell in the Southern Suburbs, ask us to talk you through the listing, the photographs and the documents before anything goes online.
What must an estate agent do under POPIA?
An estate agent must meet eight conditions for lawful processing, and getting a client to sign a privacy form does not satisfy any of them on its own.
In property, the people who handle your information are called property practitioners under the Property Practitioners Act, which has regulated the industry since 1 February 2022 and replaced the old Estate Agency Affairs Act. POPIA sits on top of that: a practitioner can hold a valid Fidelity Fund certificate and still handle personal information badly. Here is what the eight conditions mean in a real agency.
Condition | What it means in practice |
|---|
Accountability | The agency takes responsibility for its own handling and has someone answerable for it. |
Processing limitation | Information is collected lawfully and fairly, and only what is needed. |
Purpose specification | The agency knows why it is collecting each item and tells you. |
Further processing limitation | Details collected for a viewing are not quietly reused for something unrelated. |
Information quality | Records are accurate, complete and kept up to date. |
Openness | You are told what is collected, why, and who to contact. |
Security safeguards | Reasonable technical and organisational measures protect the records. |
Data subject participation | You can ask to see, correct or delete your information where the law allows. |
The Information Officer
Every responsible party, including a small agency, has an Information Officer. In a private business the head of the business holds that role by default, and it must be registered with the Information Regulator through its eServices portal before the person takes up the duties. The officer encourages compliance, handles requests from clients and deals with the Regulator.
What this looks like day to day
A responsible agency has working procedures for:
- Protecting IDs, mandates and financial records, on paper and on screen
- Limiting who can open client files
- Securing computers, email accounts, phones and cloud storage
- Using written agreements with service providers who handle client information
- Answering requests to access, correct or delete records
- Dealing with a security compromise and the notifications that follow
- Training anyone who works there to spot phishing and avoid accidental disclosure
A useful test is to ask what the agency does when someone gets it wrong, because every business eventually has a mistake. The answer tells you far more than the privacy policy does.
What happens when an agency gets it wrong?
The Regulator can investigate complaints, issue enforcement notices and, in certain cases, impose administrative fines of up to R10 million. Most of the heaviest penalties attach to specific offences, such as ignoring an enforcement notice. The first administrative fine the Regulator issued was R5 million, against the Department of Justice in 2023, for not complying with an enforcement notice after a cyber incident. For a small agency the more realistic consequences are an investigation, a compliance order and the loss of client trust.
When you choose an agent, ask whether the agency has a written privacy policy and who the Information Officer is. If you want to know how we approach this at Lake Properties, contact us and ask.
Does an estate agent need your consent to collect or share your information?
Not always: consent is only one of the legal grounds POPIA allows, and for much of a property deal the agent relies on a different one.
This is the most misunderstood part of the Act. Section 11 lists the grounds on which personal information may be processed. They include your consent, what is necessary to carry out a contract with you, an obligation imposed by law, protecting your legitimate interests, a public law duty, and the legitimate interests of the business or a third party. Each time an agent handles your information, one of those grounds must apply.
Why the agent asks for your ID: FICA
Most of the frustration buyers and sellers feel about document requests comes from one law that is not POPIA at all. Estate agents are accountable institutions under the Financial Intelligence Centre Act (FICA), the anti-money-laundering law. They must identify and verify their clients, and that is a legal obligation, so POPIA allows it without a separate consent.
In practice that means a certified copy of your ID or passport, proof of residential address that is normally not older than three months, your tax number and, depending on the deal, information about the source of the funds. The Financial Intelligence Centre supervises this regime. The due diligence is triggered when a business relationship starts, for example when you sign a mandate, or when a transaction is concluded. It is not triggered simply because you walked through an open house.
So two things are true together. An agent is entitled, even required, to collect FICA documents from the client. And the agent must still look after them properly, collect no more than FICA actually requires and not reuse them for marketing.
When consent really matters
Consent becomes important when the agency wants to do something that no other ground covers. Examples include:
- Sending unsolicited electronic marketing to someone who is not an existing customer
- Publishing identifiable personal details or photographs of you where no other ground applies
- Passing your details to another business for its own marketing
- Using your information for a new purpose unrelated to the one you gave it for
Common questions
Can the agent share my details with the conveyancing attorney? Yes. A transfer cannot happen without the agent, the attorneys and often the bank exchanging relevant information, and that sharing is necessary for the contract and for the legal process.
Can the agent give my number to another agency? Not automatically. Passing your details to an unrelated agency for its own marketing is very different from sharing what a service provider needs to do its job. The test is purpose, legal ground and transparency.
Can the agent WhatsApp me about other houses? It depends. A reply to your request about a specific property is not the same as an unsolicited campaign. Section 69 of POPIA covers the second kind, and we look at it in the marketing section below.
If you want property alerts but not general advertising, tell your agent precisely what you agree to receive and how to stop it. We are glad to set that up properly at Lake Properties.
Your POPIA rights as a buyer or seller
POPIA gives you rights you can use against any estate agency, bank or attorney holding your information, and none of them require you to hire a lawyer.
- The right to know. You can ask whether an organisation holds personal information about you and ask for access to it, subject to the Act. Many agencies publish a PAIA manual that explains how to make this request.
- The right to correct. If your details are inaccurate, incomplete, misleading or out of date, you can ask for them to be corrected.
- The right to deletion. You can ask for information to be deleted or destroyed in the circumstances the Act provides for. This is not absolute: an agency may be entitled or required to keep some records, for example its FICA records.
- The right to object. You can object to certain processing, including processing based on legitimate interests and direct marketing.
- The right to withdraw consent. Where consent was the ground, you can take it back, although that does not undo what was lawfully done before.
- The right to be told about a breach. If your information has been accessed or acquired by an unauthorised person, you must be notified in the way the Act sets out.
- The right to complain. If you are not satisfied, you can complain to the Information Regulator.
The prescribed forms are published on the Information Regulator's POPIA forms page. Form 1 is for objecting to processing, Form 2 for requesting correction or deletion, and Form 5 for lodging a complaint with the Regulator. Under the amended POPIA Regulations that took effect in 2025, an objection or a correction or deletion request must be free of charge and can be made through ordinary channels such as email or WhatsApp, and a responsible party must tell you in writing what it did about a correction or deletion request within 30 days.
How to use your rights
- Find out who holds your information: the estate agency, the bank, the attorney or someone else.
- Contact that organisation's Information Officer or privacy contact.
- Say clearly what you want: access, correction, deletion or an end to marketing.
- Expect to prove who you are, and do it through a secure channel, not by sending your ID to a random email address.
- Keep a copy of your request and of any reply.
- If you get nowhere, take the matter to the Information Regulator at enquiries@inforegulator.org.za or 010 023 5200.
A clear written request is almost always the quickest way to get a response. If you are one of our clients and want to see or correct what we hold about you, send us an email at info@lakeproperties.co.za and we will deal with it.
What happens if an estate agency leaks your personal information?
If your information is accessed or acquired by an unauthorised person, the agency must tell both the Information Regulator and you, and since April 2025 it must report to the Regulator through the online eServices portal.
POPIA calls this a security compromise. Section 22 requires notification as soon as reasonably possible, and the Regulator's guidance is that an agency should report on the information it has and update the report as the picture becomes clearer, rather than waiting until its investigation is finished. The Regulator has also said that the reason a compromise happened, a simple mistake for example, does not remove the duty to report.
Typical property-sector examples include:
- An agent emailing your ID copy to the wrong recipient
- A lost phone or laptop holding client files
- A criminal breaking into an agent's email account
- Banking details sent to an unauthorised person
- Printed documents thrown away without being shredded
The scam that follows
The breach itself is often not the worst part. Criminals who get hold of transaction details can write to you as the "attorney" or "agent" at exactly the moment you expect payment instructions, and ask you to pay the deposit or transfer costs into a new account. Because the emails look convincing and the amounts are large, buyers lose substantial money this way.
What to do if your documents have been exposed
- Ask the organisation what happened. Find out which information was affected and what they are doing about it.
- Protect your accounts. If banking information or login details were involved, phone your bank on the number printed on your card or on its official website.
- Treat every payment instruction as suspect. Confirm any banking details, and above all any change of banking details, by phoning the attorney's office on a number you already had before the deal began.
- Keep the evidence. Save the messages, emails, dates and any correspondence.
- Escalate if necessary. If you believe POPIA was breached, you can lodge a complaint on Form 5. The Regulator's fact sheet on handling security compromises explains how, and organisations report incidents through the Regulator's eServices portal.
If you receive an instruction to pay money into a new account, phone someone you already know to confirm before you pay a cent. If something like this has happened to you in a deal we are involved in, call us straight away on 083 624 7129.
POPIA and property marketing: can your details be used for advertising?
Yes, but electronic marketing to people who are not your customers needs their prior opt-in consent, and the agency may ask for it only once.
POPIA does not stop property marketing. An agency can advertise a house using the photographs, features, asking price and agency contact details, and it can reply to someone who asked about a specific listing. The rules bite when an agency uses personal information to market directly to people.
Section 69 governs direct marketing by electronic communication: email, SMS, WhatsApp and automated calling. The Information Regulator's Guidance Note on Direct Marketing, issued in December 2024, treats telephone calls as electronic communication too. The main rules are:
- Consent comes first. If the person is not an existing customer, they must opt in before marketing starts. Silence or a failure to opt out is not consent.
- One request only. An agency may approach a person once to ask for consent, and only if they have not already refused. If they say no, or do not answer, the agency should not ask again.
- A narrow exception for customers. An existing customer whose details were obtained in the course of a sale can be sent marketing about similar products or services, as long as they were given a chance to object at the time and every message offers an easy way to opt out.
- Identify the sender. Every message must say who it is from and give a simple way to stop.
Marketing by non-electronic means, such as printed flyers, can be justified on other grounds, including legitimate interest, but you can still object.
What is generally fine
Advertising a listing with approved photographs. Answering an enquiry about a particular house. Sending the transaction updates a client needs. Property alerts a person has actually asked for.
What can create a problem
- Sending unsolicited electronic advertising without the consent the law requires
- Selling or sharing a client contact list without a proper legal ground
- Publishing IDs, private financial records or other unnecessary personal details
- Using someone's photograph in promotional material without a lawful basis
- Carrying on with marketing after a valid objection or withdrawal of consent
Newsletters and property alerts
If you sign up for listings, know what you are agreeing to. Receiving alerts about similar homes is not the same as agreeing to marketing from the agency's partners. A well-run agency separates essential transaction messages from optional promotional ones and keeps a record of who agreed to what.
If you are on the receiving end of messages you did not agree to, you can object, using Form 1 if you want a formal record. And if you run a property business yourself, now is a good moment to review how you collect and record marketing permission. If you would like to see how Lake Properties approaches marketing permission, just ask us.
Wynberg, Crawford and Athlone compared: where POPIA risks tend to show up
POPIA is national law, so your rights are identical in Wynberg, Crawford and Athlone, but the practical risks differ with the kind of property and deal that is common in each suburb.
The comparison below is about privacy and information handling, not prices or crime statistics. It describes tendencies, not rules, and any suburb can have any kind of deal.
| Wynberg | Crawford | Athlone |
|---|
Common deal profile | Freehold homes, sectional title flats and commercial property side by side | Established family homes, often bought by first-time buyers | Established homes alongside commercial and industrial premises |
Where privacy risk tends to show | Larger volumes of documents: sectional title levy and body corporate papers, and company or trust buyers | Occupied family homes photographed for listings, with children's items and personal documents in view | Large transfers and high-value payments that attract payment-instruction fraud |
Information handled most | Company and trust documents, FICA files for directors and trustees | Bond applications and first-time-buyer financial documents | Banking details, deposit and transfer-cost payment instructions |
Main practical priority | Controlled access to client files and documents | Privacy in photography and viewings | Verifying every payment instruction independently |
Best question to ask your agent | Who in the agency can open my file, and how is it stored? | Can I approve the listing photos before they go live? | How will you confirm banking details with me? |
Wynberg
Wynberg mixes freehold homes, flats and commercial property, so an agency here may be handling company resolutions, trust deeds and director IDs as well as ordinary buyer files. If you buy or sell through a company or trust, ask how those extra documents are held and who gets to see them.
Crawford
Crawford is a family-home suburb where many buyers are purchasing for the first time. Sellers often live in the house while it is marketed, so a viewing can mean strangers walking past family photos and school bags. For buyers, a first bond application is also the first time most people hand over a full set of financial documents.
Athlone
Where deals are larger or involve commercial premises, the money moving at transfer attracts more attention from criminals. In Athlone the safest habit is the simplest: never act on a changed set of banking details until you have confirmed it by phone with someone you already know.
What stays the same
Wherever the property is, the same three questions apply. Why do you need this information? Who else will see it? How long will you keep it?
Whether you are buying or selling in Wynberg, Crawford, Athlone or any other Southern Suburbs area, speak to us at Lake Properties and we will take you through what to expect before you hand over a single document.
Four illustrative scenarios: how POPIA plays out in a property deal
These four scenarios are illustrations built from situations that commonly arise in property transactions. They are not Lake Properties client cases and they are not court or Regulator findings, but each one shows a principle you can use.
Scenario 1: The ID document sent to the wrong person
A seller emails a copy of her ID and proof of address to the agency so that it can complete its FICA file. A staff member forwards the email to a prospective buyer by mistake.
What went wrong: her documents reached someone with no reason to hold them.
What should happen: the agency should contain the incident, ask the buyer to delete the email, assess the risk and report the security compromise to the Information Regulator and to the seller.
The lesson: double-check the recipient before sending identity documents, and use a secure channel where you can.
Scenario 2: The buyer who started getting unrelated adverts
A buyer asks about a three-bedroom house in Crawford. Within weeks he is receiving promotional messages from businesses he has never dealt with.
What went wrong: his contact details may have been reused or shared for a purpose he never agreed to.
What should happen: he can ask the agency where the details came from, what they are being used for and which legal ground applies. He can also object to the marketing in writing and, if that fails, complain to the Information Regulator.
The lesson: an enquiry about one house is permission to answer that enquiry, not to distribute your number.
Scenario 3: The listing that gave away too much
An agent publishes photographs showing family portraits and a desk covered in paperwork. The description mentions that the owners are overseas for six weeks.
What went wrong: the listing disclosed personal details and announced that the house would be empty.
What should happen: the seller and agent review the photographs together, take the portraits and papers out of view and strip the travel detail from the advert.
The lesson: approve your photographs before they go live, and keep your movements out of public marketing.
Scenario 4: The payment instruction that arrived by email
A buyer is two days from paying the deposit when an email arrives that looks like it comes from the conveyancing attorney's office. It gives a different bank account to the one in the original instructions.
What went wrong: nothing yet, which is exactly the point. The buyer stopped and phoned the attorney's office on the number from the original paperwork. The email turned out to be from a criminal who had been reading a compromised mailbox.
What should happen: the buyer reports it to the attorney and the agent immediately, so that the compromise can be contained and reported, and pays only into the verified account.
The lesson: confirm every change of banking details by phone, using a number you already hold.
Before your property is advertised or your documents start moving, ask your agent to go through these risks with you. At Lake Properties we are happy to do that on the first call.
Ten questions buyers and sellers ask about POPIA
These are the questions we hear most often, answered directly, with the practical step to take after each one.
1. Is POPIA compulsory for estate agents in South Africa?
Yes. Any estate agency or property practitioner that processes personal information in South Africa must comply with POPIA, whether it is a large franchise or a one-person agency. The core provisions have been in force since 1 July 2020, and the 12-month grace period ended on 30 June 2021. The exact duties depend on what the agency does, but the eight conditions for lawful processing, the Information Officer requirement and the security compromise rules apply to everyone. What to do: ask for the agency's privacy policy and the name of its Information Officer.
2. Why does my agent ask for so many documents, and can I refuse?
Because estate agents are accountable institutions under FICA, the anti-money-laundering law, and must verify who their clients are. Expect to provide a certified ID or passport, recent proof of address, a tax number and, in some deals, information on the source of funds. POPIA allows this because the law requires it. You can refuse, but the agent then generally cannot proceed with the mandate or the transaction. What to do: hand over the documents through a secure channel and ask how long they will be kept.
3. Can an estate agent ask for my ID before I view a house?
An agent may have good reasons to identify visitors, such as safety when showing an empty or occupied home. But FICA due diligence is triggered by a business relationship or a transaction, not by a casual viewing, and POPIA does not create a rule that every viewer must supply a full ID copy. The question is whether the request is justified and proportionate. What to do: ask why it is needed, whether a copy must be kept and how it will be protected. A name, number and a brief look at the ID may be enough.
4. Can an estate agent share my phone number with another agency?
Not automatically. Sharing your details with an authorised service provider, such as the conveyancing attorney, to do a necessary job is different from passing them to an unrelated agency for its own marketing. The test is purpose, legal ground and transparency, and electronic marketing generally needs your prior opt-in consent. What to do: ask who will receive your details and why, and say clearly if you do not want them passed on.
5. Can a seller refuse to have the house photographed?
You can set boundaries, and you should. What may be photographed and where the images are published are matters for the mandate and for your agreement with the agent, and the agent will usually need images to market the property properly. You can ask for rooms to be excluded, for personal items to be cleared first and to approve the final selection. What to do: agree the photography rules and the intended marketing channels before the photographer comes.
6. Does POPIA stop a property address from being published online?
No. There is no blanket ban, because a location is usually necessary for legitimate marketing, and ownership details at the Deeds Office can be searched anyway. The privacy issue is how much additional detail is published and whether it creates a safety risk, for example saying that the house is empty. What to do: decide with your agent how precise the location in the advert will be and keep access and security details out of it.
7. Can I ask an estate agency to delete my details after I sell?
Yes, you can ask, using Form 2 or a written request, and under the amended Regulations the agency must respond within 30 days. But deletion is not absolute. Records the agency is legally required to keep, such as its FICA records, which are normally retained for at least five years, or records needed for accounting, tax or a dispute, can lawfully stay. What to do: ask which records will be deleted, which must be kept and why, and ask to be removed from marketing lists.
8. Can an agent keep sending me property adverts after I object?
Where the marketing is something the law prohibits without your consent, or you have validly objected or withdrawn consent, the agency must stop. Once you object, a compliant agency keeps a record so that you are not contacted again. What to do: say clearly, preferably in writing or on Form 1, that you object to marketing, keep a copy and note the date. If it continues, complain to the Information Regulator.
9. What should I do if my banking details are leaked during a transfer?
Phone your bank immediately, using the number on your card or the bank's official website, explain the exposure and follow its instructions. Then tell the agency and the attorney, keep every relevant message and be very wary of any new payment instruction. The agency or attorney responsible for the leak must report the security compromise to the Regulator and notify you. What to do: treat every instruction to change banking details as suspicious until you have confirmed it by phone on a number you already had.
10. Where can I report a POPIA violation, and what can happen to the agency?
Start with the organisation's Information Officer. If that gets you nowhere, lodge a complaint with the Information Regulator on Form 5, or write to enquiries@inforegulator.org.za. The Regulator can investigate, issue an enforcement notice and, for certain offences such as ignoring a notice, impose administrative fines of up to R10 million. Complaints about an agent's professional conduct, as opposed to privacy, can go to the Property Practitioners Regulatory Authority. What to do: keep copies of everything and be specific about what happened and when.
If your question is not here, ask us and we will either answer it or point you to the right place.
Your property privacy checklist
Work through these twelve points before you sign a mandate, send documents or approve a listing.
Before you share documents
- Confirm that the agent, bank or attorney receiving the documents is who they say they are
- Ask why each document is needed and how long it will be kept
- Send identity and financial documents only through a verified, secure channel
Before your property is marketed
- Check the photographs for family portraits, paperwork and valuables
- Confirm what property and owner information will be published
- Tell the agent which marketing messages you do and do not want
During the transaction
- Ask who will receive your personal information and why
- Confirm every change of banking details by phone, on a number you already hold
- Keep copies of privacy notices, the mandate and key correspondence
After the transaction
- Object to marketing you no longer want
- Ask which records can be deleted and which must be kept
- Report any suspected breach straight away
Tick these off before you appoint an agent or send anything important. If you would like a second pair of eyes on your documents or listing first, we can help.
Where to go for official help
For anything that goes beyond what an agent can answer, these are the official places to start.
If you need to | Go to |
|---|
Understand POPIA and see the Regulator's guidance | The Information Regulator's POPIA page |
Object to processing, ask for correction or deletion, or lodge a complaint | The Regulator's POPIA forms (Forms 1, 2 and 5) |
Understand how security compromises are handled | The Regulator's fact sheet on security compromises |
Report a security compromise (organisations) | The Regulator's eServices portal |
Contact the Regulator directly | enquiries@inforegulator.org.za or 010 023 5200 |
Ask about FICA and anti-money-laundering duties | The Financial Intelligence Centre |
Complain about an agent's professional conduct or check a Fidelity Fund certificate | The Property Practitioners Regulatory Authority (PPRA) |
Get advice on a specific legal dispute | A qualified attorney |
This article is general information, not legal advice. If you have a dispute about how your personal information was handled, speak to an attorney or take it to the Regulator.
For anything property-related in the Southern Suburbs, from valuations to sales and rentals, you are welcome to get in touch with the team at Lake Properties.
How Lake Properties can help
We are an independent agency in Wynberg, and we help buyers, sellers, landlords and tenants across the Southern Suburbs make decisions with the full picture in front of them.
A property deal is about more than agreeing a price. It runs on trust, clear communication and good paperwork, and part of that is knowing where your documents are going. We work in Crawford, Athlone, Rondebosch East, Claremont, Constantia, Plumstead, Lansdowne and the surrounding areas, and we handle residential and commercial sales, rentals, valuations and vacant land.
If you are selling, we can walk you through:
- What information is needed to market your property, and what should stay private
- How photographs and viewings are arranged
- The documents a sale requires and who needs to see them
- How to prepare for offers and for transfer
If you are buying, we can explain:
- What you will normally be asked for when you make an offer
- What happens after an offer is accepted
- How the bond originator and the conveyancing attorney fit in
- The questions worth asking before you hand over your documents
For legal advice on a specific POPIA dispute, speak to an attorney or the Information Regulator. For everything around the sale itself, call Russell on 083 624 7129, email info@lakeproperties.co.za or visit lakeproperties.co.za.
Lake Properties Pro-Tip: protect your personal information before you sign
Phone before you pay, and ask before you send: those two habits stop most of the privacy and fraud trouble in a property deal.
Signing a mandate or handing over your ID does not give everyone involved unlimited permission to use your information. Before you share a document, check who is receiving it, understand why they need it and ask how it will be stored and shared. Before your property is advertised, look at the photographs and the wording. During the transfer, confirm any change of banking details by phone, on a number you already had, however convincing the email looks.
POPIA protects your personal information, but it cannot remove every risk. Your own caution still counts for a great deal, and a good agent will welcome your questions rather than resent them.
Buying or selling in Cape Town? Ask before you hand anything over. A professional transaction should be as open about how your details are handled as it is about the price.
Lake Properties: helping Cape Town buyers and sellers make informed property decisions.
Sources checked
Figures and dates were checked against these pages (search excerpts, not full documents):
Lake Properties 
