POPIA compliance checklist
The 7 things every SA agent needs to be doing.
POPIA is not optional, and an estate agency holds exactly the information it was written for: ID numbers, proof of address, bank letters, and financial detail on both sides of a deal. Here are the 7 things every South African estate agent must be doing to stay compliant, and what RealtyPA does and does not do for each one.
- 1
Have a privacy policy on your website
Plain-language description of what data you collect, why, and how. Every RealtyPA website ships platform default legal pages, and the website drawer has "Privacy Policy (HTML)", "Terms & Conditions (HTML)", "Cookie Policy (HTML)" and "PAIA Manual (HTML)" fields to override them.
- 2
Get explicit consent, scoped to purpose
Consent for marketing is separate from consent for deal updates. The POPIA tab on every contact tracks seven purposes on their own: WhatsApp, phone, SMS, email, hold and process data, property alerts and marketing. Tapping one opens its own panel, "Add WhatsApp Preference" for the first, with four fields: Communication preference, Consent given, Consent removed and Consent confirmed by. Getting the consent is still yours to do, and one case needs watching: contacts RealtyPA creates for you arrive already switched to "Opted in" with Consent confirmed by set to a system name rather than a person. A Property24 or Private Property lead stamps WhatsApp, phone, SMS, email and hold and process data. A contact created from a deed owner lookup stamps hold and process data. A Mailchimp import stamps email, marketing and hold and process data. Work through those before you treat them as consent you can stand behind.
- 3
Keep a change record on every contact
Every contact has an Activity tab logging Created, Edits, Stage changes and Deleted, with the person and the timestamp. Read-only views are not logged, so treat it as a change history rather than an access log.
- 4
Honour subject access requests
A data subject can ask for a copy of what you hold, or ask you to delete it. Neither is one click. The Contacts list has no export of its own, so the copy comes from the "Export Data" tab on your workspace, which downloads whole datasets as CSV and is workspace-admin only. Each contact record has a "Delete contact" button, but it stamps the record as deleted and takes it out of your lists rather than erasing the row. Write your own retention and erasure step around both.
- 5
Have a data processing agreement
Under POPIA you are the responsible party and your CRM is an operator processing on your behalf, so the two of you need a written agreement covering it. "Joint controllers" is GDPR vocabulary and the wrong relationship to write into your file. RealtyPA does not issue that agreement as part of the product. Clause 7.4 of the Terms of Service says plainly that RealtyPA is not the responsible party for the data you hold here and that you remain the responsible party, so request the agreement from RealtyPA support and get it signed before you file your compliance paperwork.
- 6
Notify breaches as soon as reasonably possible
POPIA requires you to notify the Information Regulator and the affected people as soon as reasonably possible after you discover a compromise. There is no 72 hour deadline in POPIA. That clock is GDPR Article 33, so do not copy it into your incident procedure. Name the person who owns the call and write the procedure down before you need it. RealtyPA does not run breach detection on your workspace.
- 7
Train your agents
Every agent needs basic POPIA awareness. The POPIA tab states the rule in the app, "In line with the POPI Act, your client needs to opt-in before they can receive digital communication from you", but the training itself is yours to run.
From agents who've done it.
Keep the signed consent, not just the switch. The POPIA tab has a "POPIA Proof of Consent form" upload under Documents, so the paper sits on the same contact record as the seven preferences and one record answers the whole question.
Schedule a quarterly review of your consent records. Stale consent is invalid consent.
There is no password to leak. Signing in to RealtyPA is a WhatsApp number plus a 6 digit one time code, so access follows the phone in your agent's pocket rather than a shared secret someone can email around. The code falls back to email only when WhatsApp refuses the message.
Want to try it yourself?
Start with 30 days free and 5 property reports. No card. Same login across desktop and mobile.