← All guides

Guide

POPIA for letting agents: what you may hold, and for how long

A letting agency holds more sensitive information about more people than almost any other business on its street — ID copies, payslips, bank statements, credit reports, and the same again for everyone who applied and did not get the property. Most agencies dealt with POPIA once, in 2021, by adding a consent paragraph to the application form. That paragraph is the smallest part of the obligation. Here is what the Act requires, what you may keep, and the contract most agencies do not have.

You already have an information officer

The Protection of Personal Information Act 4 of 2013 calls the organisation that decides why and how personal information is processed the responsible party. An agency that takes applications, screens them, runs leases and collects rent is squarely that — for every tenant, applicant and landlord on its books.

You do not so much appoint an information officer as discover you are one. The Information Regulator's guidance note on information officers states that the information officer of a private body is by default the head of that body — in a small agency, the principal, whether or not anyone wrote it down. The same guidance is blunt that registration with the Regulator is not optional: it calls registration both the prerequisite for taking up the POPIA duties and "a compulsory requirement". Deputies may be appointed; the responsibility cannot be delegated away.

The companion obligation is the PAIA manual: section 51 of the Promotion of Access to Information Act requires every private body to compile one, and the exemption that once relieved smaller private bodies of it has expired.

What you may actually hold on a tenant

POPIA works from purpose, not from a list of permitted documents. Section 13 requires information to be collected for a specific, explicitly defined and lawful purpose; section 10 — minimality — requires it to be adequate, relevant and not excessive for that purpose. The question for every item in your application pack is therefore: which decision does this document let me make? Three months of bank statements supports an affordability decision; an ID copy supports identity verification and the lease. An applicant's photograph, religion or medical history supports nothing you are entitled to decide, and keeping the field because the form has always had it is what minimality prohibits.

Consent is also not your only lawful basis, and leaning on it alone is a weakness. Section 11 lists several, including that processing is necessary to perform a contract to which the data subject is a party, or to comply with a legal obligation. Rent collection, deposit handling and lease administration sit in the contractual basis, which does not evaporate when a tenant withdraws consent.

Section 26 prohibits the processing of special personal information outright except in defined circumstances. The categories include religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, and criminal behaviour. A screening process that records race, asks about health or notes criminal history is inside section 26 and needs a specific justification rather than a tick box.

How long you may keep it

Section 14 is the condition most agencies fail, and it fails quietly. Records must not be retained longer than is necessary for the purpose they were collected for, and must be destroyed or de-identified as soon as reasonably practicable after you are no longer authorised to keep them.

That is not an instruction to delete everything the week a tenant moves out, because section 14 permits retention where another law requires it. Section 24 of the Companies Act 71 of 2008 requires company records to be kept for seven years. Where an agency is an accountable institution under the Financial Intelligence Centre Act, section 23 of that Act requires due diligence records to be kept for five years from the end of the business relationship. Whether a given letting agency is one is a real question: property practitioners appear in Item 3 of Schedule 1, but the FIC has issued guidance on which of them perform activity equivalent to an estate agent's, and a pure rental management business is not obviously inside it.

The real exposure is elsewhere. For every tenancy you placed, you screened three or four applicants you did not. Their ID copies, payslips, bank statements and credit reports are still in the shared drive and in the WhatsApp thread where somebody forwarded them. No statute requires you to keep those, and the pile grows every month. Set a retention period for unsuccessful applications, put it in the application form's privacy notice, and run the deletion.

Your software provider is an operator

Section 20 provides that an operator — anyone processing personal information on your behalf — may process it only with your knowledge or authorisation. Section 21 then imposes a formality agencies routinely miss: the responsible party must, in terms of a written contract, ensure the operator establishes and maintains the security measures required by section 19 — appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of the information.

Your vendor's security failure is your compliance failure, because you were the one required to have the contract. This covers more suppliers than agencies expect: the property management system, the screening provider, the accounting package, the email host, the bookkeeper who logs in monthly. Ask each for its operator agreement; one that cannot produce it is telling you something about the rest of its compliance.

The first hours of a breach

Section 22 requires notification where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. Both the Regulator and the affected data subjects must be told, as soon as reasonably possible after discovery, and the notice must give them enough information to take protective measures. Notification may be delayed only where a public body investigating offences, or the Regulator itself, determines that notifying would impede a criminal investigation. The Regulator has published a prescribed form for notifying it, and its guidance states that failing to use the form may render the notification non-compliant. Find it before you need it.

Enforcement is not theoretical: the Regulator fined the Department of Justice R5 million in July 2023 for failing to comply with an enforcement notice, and the Act's ceiling for an administrative fine is R10 million. Most of what the Regulator has acted on is the failure to respond after being told, not the incident itself.

Marketing to your database changed this year

Section 69 restricts direct marketing by electronic means — email, SMS, automated calls — to data subjects who have consented. The Regulator's guidance note on direct marketing, published on 3 December 2024, tightened the reading: silence is not consent, so a tenant never asked about marketing specifically has not consented, and consent from a non-customer must be sought using the prescribed Form 4. For an existing customer you may market similar products where you obtained the contact details in that sale and give a reasonable opportunity to object.

A second regime arrived this year. Amended Consumer Protection Act regulations, gazetted on 15 April 2026, establish a national opt-out registry run by the National Consumer Commission, with registration of direct marketers and consumers commencing in July 2026. The NCC has stated that non-compliant direct marketers face an administrative penalty of up to R1 million or 10% of annual turnover, whichever is greater. The obligations are cumulative: a lawful basis under POPIA does not excuse marketing to someone who has registered a block.

Where this needs an attorney

Most of the above is administration and needs no opinion. Four things do: a live security compromise, where the notification wording itself carries risk; a screening process that touches section 26 special information, particularly criminal history or health; a data subject request you believe you may refuse; and any transfer of personal information outside South Africa, which section 72 governs separately and which almost every cloud service raises.

If you are reviewing what you hold on tenants, our guide on rental deposits under the Rental Housing Act covers the records you are separately required to produce on demand.