Consent & Personal Data
Applicable Legislation
| Act | Section | What It Governs |
|---|---|---|
| POPIA | §9–10 | Processing must be lawful — consent, contract necessity, or legitimate interest |
| POPIA | §11–12 | Consent must be voluntary, specific, and informed |
| POPIA | §13 | Collection must be for a specified, lawful purpose — no mission creep |
| POPIA | §14–15 | Data must be adequate, relevant, not excessive; kept accurate and up to date |
| POPIA | §16–17 | Data subjects have a right to access their data and to object to processing |
| POPIA | §18 | Data subjects must be notified of what data is collected, why, and with whom it will be shared |
| POPIA | §19–20 | Security safeguards — reasonable measures to protect personal information |
| POPIA | §21–22 | Data breach notification — must notify Regulator and data subject if compromise is likely to cause harm |
| CPA | §11 | Consumer right to plain language in all documents |
✅ Compliance Checklist
- Privacy notice / consent form is presented before collecting any personal data from a lead
- Consent is specific — e.g. "I consent to Nostics Property holding my data to help me find a property" not just a blanket "I agree to terms"
- Consent is recorded and auditable — timestamped + source recorded
- Data collected is limited to what is needed (name, contact details, property requirements) — not excessive
- The lead/client is told who will have access to their data (the agency, the developer, the bank)
- The lead/client is told how long the data will be kept
- Security measures are in place — encrypted storage, access controls on CRM, secure authentication
- Data subject access request procedure is documented and can be actioned within 30 days
- Opt-out / deletion request can be processed within a reasonable time
- Data breach response plan exists — Information Regulator can impose up to R10 million fine or imprisonment
❌ Prohibited Actions
- ✗ Collecting a lead's ID number "just in case" before mandate stage — excessive collection
- ✗ Sharing client data with a bond originator or developer without separate consent
- ✗ Keeping data indefinitely — must have a retention policy
- ✗ Storing personal data on unencrypted laptops, shared drives, or personal devices without controls
- ✗ Using a lead's data for purposes they did not consent to (e.g. signing them up for a newsletter without consent)
⚠️ Warning Flags
- "I'll just save their number in my phone" — personal device storage needs security safeguards too.
- WhatsApp groups for property listings — adding leads to a broadcast group without consent is a POPIA violation.
- CRM data retention: if you close a deal and never delete old data, you are in violation if a client withdraws consent years later.
- Referrals: getting a name from a friend is still processing — the referred person must be informed and consent before you contact them.