Guide
POPIA for estate agents
Rental agencies handle a lot of personal information: IDs, payslips, bank statements, credit results. POPIA governs how you collect, use and store it. This is a practical overview, not legal advice — check specifics with your compliance adviser.
Collect with consent and a stated purpose
Tell applicants what you are collecting, why, and what you will do with it, and get their consent. Do not collect more than you need for assessing and administering the tenancy — that is the minimality and purpose-limitation principle in practice.
Use it only for that purpose
Applicant data gathered to assess a tenancy should not be reused for unrelated marketing or shared beyond the parties who need it (for example, the credit bureau for the check the applicant consented to).
Store it securely
Bank statements and IDs sitting in an email inbox or a shared drive are a weak point. Keeping applicant and tenant records in a structured system with access control reduces the exposure and makes it easier to answer a data-subject request.
Keep it only as long as needed
Once an applicant is declined and any dispute window has passed, or once a tenancy has ended and record-keeping obligations are met, personal information should be deleted or de-identified rather than kept indefinitely.
Have an operator agreement with your tools
Where a third-party platform processes personal information on your behalf, POPIA expects a written arrangement covering security and permitted use. Ask any vendor how they handle this.
Frequently asked questions
- Do I need written consent to run a credit check?
- You need the applicant’s consent to process their information for the credit check, and it should be recorded. Building it into the application form is the cleanest approach.
- How long can I keep a declined applicant’s bank statements?
- Only as long as you have a lawful reason — typically a short window to handle a dispute about the decision. After that they should be deleted. Set a retention rule rather than deciding case by case.
- Does using Paydwell make my agency POPIA compliant?
- No tool makes you compliant on its own. Paydwell helps with the mechanics — structured collection, access control, records against the tenancy instead of loose files — but consent wording, retention rules and your operator agreements are still your responsibility.
Keep reading
Ready to automate rent collection?
We're live and onboarding estate agents now. Get in touch and we'll get you set up.
Contact us