Residential estates' new rules on how they collect and store visitor data
Residential estates across South Africa are facing major changes to how they handle your personal information at the gate. Here is what every homeowner and body corporate needs to know before the rules take effect.
South Africa's Information Regulator is finalising a code of conduct that will fundamentally change how residential estates, gated communities, and complexes collect and manage visitor data.
The code is expected to be in place by the end of March 2026 and applies to any entity with security teams controlling entry or exit points.
ALSO READ: South Africa's fuel price crisis and what it could mean for your cost of living in 2026
What does the new code of conduct cover?
Published in a government gazette in 2023, the code sets out what personal information gate guards and surveillance systems can legally collect from visitors, and how that information must be handled.
It applies to residential estates and sectional title schemes, lifestyle estates, gated communities, bodies corporate, homeowner associations, commercial parks and office parks, reports MyBroadband.
What information can guards legally collect?
Gate guards will generally be permitted to ask for a visitor's name, surname, ID or passport number, mobile number, vehicle registration and time, date, gate and host details. However, this information should only be collected if justified by the relevant risk profile.
The core principle, as digital access control specialists ATG Digital describe it, is a shift from collecting everything just in case to collecting only what is truly necessary. Under the Protection of Personal Information Act (POPIA), personal information must be relevant, not excessive, and used for a clearly defined purpose.
Information Regulator chair Advocate Pansy Tlakula has warned that scanning a driver's licence, for example, could expose a wide range of POPIA violations, given that it contains a person's name, home address and ID number.
What practices should estates avoid?
Companies risk being investigated if guards leave visitor information books open or accessible to unauthorised personnel. Copying ID books or licences without due cause and collecting unnecessary details such as employment history or family information are red flags.
Visitors who record and report these instances could trigger charges for POPIA breaches, potentially resulting in fines or criminal prosecution.
What are the penalties for non-compliance?
The Information Regulator can issue administrative fines of up to R10 million. In 2023, the Department of Justice received a R5 million fine following a ransomware attack and data breach.
Beyond fines, POPIA allows any visitor to bring a civil action for damages against a company for distress caused by the mishandling of their personal data, which represents a significant risk for bodies corporate and property owners.
ALSO READ: Competition Commission warns businesses over fuel price gouging
HOW TO LISTEN TO EAST COAST RADIO
1. Listen to East Coast Radio on the FM (frequency modulation) spectrum between 94 and 95 FM on your radio.
2. Listen live to ECR by clicking here or download the ECR App (iOS/Android).
3. Listen to East Coast Radio on the DStv audio bouquet, channel 836.
4. Switch to the audio bouquet on your Openview decoder and browse to channel 606.
5. Listen to us on Amazon Alexa.
Follow us on social media:
Image courtesy of iStock