Question 1

Can we require fingerprints or facial recognition for entrants?

Accepted Answer

You can, but biometrics are special personal information and attract heightened protection. Conduct a PIIA first, document why a less intrusive method will not do, and offer an alternative where reasonable.

Question 2

Are you considered to be a Responsible Party or an Operator?

Accepted Answer

Both
We are the Operator regarding the data captured by ATG devices at the sites of our customers
We are the Responsible Party regarding the data we collect through our normal business operations (Customer, Supplier, Staff)

Question 3

Are you obliged to become compliant with POPIA?

Accepted Answer

Yes we are, as both an Operator and a Responsible Party

Question 4

Do you need to register with the Regulator?

Accepted Answer

Yes, as an Operator regarding the data we collect on behalf of customers

Question 5

Do you need an Information Officer?

Accepted Answer

Yes we do, and this IO will also need to be registered with the Regulator

Question 6

Do you need to consider PAIA?

Accepted Answer

Yes, in order to show how we intend to handle requests for information

Question 7

Do you process personal information?

Accepted Answer

Yes we do

Question 8

What kind of personal information do you process?

Accepted Answer

Scanned Data from Customer Sites
Customer Data (Names, Reg Numbers, Banking Details, Contact Details)
Supplier Data (Names, Reg Numbers, Banking Details, Contact Details)
Staff Data (Names, ID Numbers, Bank Details, Special Personal Information, Contact Details)

Question 9

Do you need consent from the data subject?

Accepted Answer

Yes

Question 10

Do you need to train staff on POPIA?

Accepted Answer

Yes

Question 11

Do you need a Complaints Procedure?

Accepted Answer

Yes

Question 12

Are you responsible for determining the Retention Periods?

Accepted Answer

Only for the information we gather as the Responsible Party
For the information we collect as an Operator, our customer will determine the Retention Periods.

Question 13

How long can we keep visitor records?

Accepted Answer

Only as long as necessary for the purpose. For routine visitor registers that is typically a matter of weeks rather than years, set a defined period, justify anything longer, and enforce deletion.

Question 14

Can we share details or footage with the body corporate, a neighbour, or a WhatsApp group?

Accepted Answer

Be very careful. Information collected for access control may not be casually repurposed or circulated. Sharing footage of an individual in a community WhatsApp group, for example, is a common and serious misstep. Share only where there is a lawful basis and a genuine need.

Question 15

A data subject has asked to see everything we hold on them. Must we provide it?

Accepted Answer

Yes. Data subjects have the right to access their personal information, subject to verification of their identity and the limited grounds for refusal set out in POPIA. Have a documented process and a designated contact person so you can respond within the required timeframes.

Question 16

Who must we notify if our visitor database is hacked?

Accepted Answer

The Information Regulator, on the prescribed form, and the affected data subjects, as soon as reasonably possible after you have reasonable grounds to believe a compromise occurred. Decide in advance who will assess, draft and approve the notifications.

Question 17

Does POPIA stop us sharing footage with the police?

Accepted Answer

No. Sharing for the prevention, detection or investigation of an offence is contemplated by the Act. Record what you shared, with whom and why, and share only what is relevant to the request.

Question 18

Do we really need all of this if we are a small access controlled environment?

Accepted Answer

The obligations apply regardless of size, but the response should be proportionate. A small complex needs the same building blocks, an Information Officer, a data map, a notice, retention, operator agreements, just at a scale that fits. Smaller does not mean exempt, it means simpler.

Frequently Asked Questions

Legal FAQ's

Can we require fingerprints or facial recognition for entrants?

Are you considered to be a Responsible Party or an Operator?

Are you obliged to become compliant with POPIA?

Do you need to register with the Regulator?

Do you need an Information Officer?

Do you need to consider PAIA?

Do you process personal information?

What kind of personal information do you process?

Do you need consent from the data subject?

Do you need to train staff on POPIA?

Do you need a Complaints Procedure?

Are you responsible for determining the Retention Periods?