POPIA for estate agents: a practical privacy checklist
An estate agency's privacy work starts long before a sale closes. Enquiries, viewing lists, identity documents and tenant screening can pass through portals, agents' phones, shared inboxes and third parties. Start by following one enquiry through to a completed or unsuccessful transaction.
By POPIA Check · AI-assisted practical guidance · Editorial update · General information, not legal advice
Follow a property enquiry through your agency
Use a fictional enquiry to map the process. The questions below help you identify evidence and decisions to review; they do not prescribe a lawful ground or approve a screening practice.
| Stage | What to examine | Evidence to gather |
|---|---|---|
| Portal or website enquiry | Which fields reach the agency, who receives them, and what the person is told at collection. | Form and portal notice versions; inbox access list. |
| Viewing and follow-up | Whether agents copy contacts to personal devices, open group chats or broadly shared spreadsheets. | Device and messaging arrangements; viewing-list access. |
| Application and screening | Which documents and checks are necessary for the purpose, and what is shared with screening providers. | Screening workflow, collection notice and provider terms. |
| Owner, buyer and professional handovers | What each recipient needs and whether the purpose and responsibilities are understood. | Recipient list, transfer process and review decision. |
| Closure and later marketing | How unsuccessful applications, completed matters and prospect lists are reviewed and retained. | Approved retention rules and campaign permission evidence. |
A practical first-week checklist
- Identify the Information Officer and the person responsible for each office's records. Locate registration evidence and the internal escalation route.
- Map portal enquiries, sales, rentals and staff records as separate activities in the information inventory.
- Review mandatory fields. Do not routinely request a full identity document at the initial enquiry stage without assessing necessity.
- Check staff leavers, shared inboxes and access to applicant documents. Replace open sharing links with appropriate restricted access.
- List portal, CRM, screening, cloud and IT suppliers. Review their roles, contracts, incident routes and hosting locations.
- Agree record-specific retention decisions, including applicable transaction or financial obligations, before deleting records.
- Review email, SMS and messaging campaigns separately from responding to a property enquiry. Test the opt-out and suppression process.
- Run a fictional access request and misdirected-document incident through the team. Record the actions that still need work.
Worked example: an unsuccessful tenant application
A rental team stores application attachments in an inbox and copies them into a shared drive. The applicant is unsuccessful, but both copies remain accessible to the whole office. Record the activity in the inventory, identify who still needs access and review the purpose and retention rule for each copy. Give the gap an owner, link it to a restricted evidence location and confirm the result after the change. Do not place the applicant's documents into the toolkit itself.
Questions that deserve a targeted legal review
- Which grounds and notices apply to collecting information from applicants, owners, screening providers and other sources?
- Are credit, criminal-behaviour, biometric or other sensitive checks necessary and subject to additional conditions or authorisation requirements?
- How do relevant property-sector, financial and record-keeping obligations affect this specific workflow?
- When may information be shared with a landlord, conveyancer or another agency, and what should each party receive?
- What conditions apply to marketing old enquiry lists or moving information through overseas systems?
Use the right tool for the next step
The free information inventory, supplier register and retention worksheet help you organise the evidence. Use the 40-question business assessment to record wider organisational controls. Run the website check separately for public privacy and policy evidence. Neither tool inspects your full transaction files or approves a screening decision.
Common questions
Does a portal's privacy notice cover our agency?
Do not assume it does. Map what the portal and agency each do, review their respective responsibilities, and check what the person is told when your agency collects or uses information.
Can we retain unsuccessful applications indefinitely?
A retention decision needs a justified purpose and applicable legal basis. Record the period, trigger, relevant obligations and any hold. This guide supplies no blanket retention period.
Is a website scan enough for an estate agency?
No. It can collect public-page evidence, but it cannot verify tenant screening, staff access, document handling, marketing permissions or internal retention.
Sources and further reading
Editorial guidance from POPIA Check, with links to primary sources. Ask your selected legal partner how the law applies to your organisation. These AI-assisted materials have not been presented as a legal partner’s reviewed advice.
Gather the evidence. Assign the actions.
Download seven editable registers with examples and step-by-step instructions.
Get the free starter toolkitKnow what to work on next.
Get a free PDF gap report, then decide whether to discuss it with Lawbella.
Start free assessmentView a sample report