Consent, justification and objection
(1) Personal information may only be processed if— (a) the data subject or a competent person where the data subject is a child consents to the processing; (b) processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party; (c) processing complies with an obligation imposed by law on the responsible party; (d) processing protects a legitimate interest of the data subject; (e) processing is necessary for the proper performance of a public law duty by a public body; or (f) processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.
(2) (a) The responsible party bears the burden of proof for the data subject's or competent person's consent as referred to in subsection (1)(a). (b) The data subject or competent person may withdraw his, her or its consent, as referred to in subsection (1)(a), at any time: Provided that the lawfulness of the processing of personal information before such withdrawal or the processing of personal information in terms of subsection (1)(b) to (f) will not be affected.
(3) A data subject may object, at any time, to the processing of personal information— (a) in terms of subsection (1)(d) to (f), in the prescribed manner, on reasonable grounds relating to his, her or its particular situation, unless legislation provides for such processing; or (b) for purposes of direct marketing other than direct marketing by means of unsolicited electronic communications as referred to in section 69.
(4) If a data subject has objected to the processing of personal information in terms of subsection (3), the responsible party may no longer process the personal information.
What this means for your estate
- Consent (subsection (1)(a)) is only one of six lawful bases, most estate processing (levy administration, access control, visitor logs) runs on “legitimate interest” (1)(f) or a legal/contractual obligation (1)(b)-(c), not consent. Don't over-rely on consent forms where a stronger basis already applies.
- Subsection (2)(a) puts the burden of proof on the estate, not the resident, if you're relying on consent, you need to be able to produce evidence of it, not just assert it happened.
- Subsection (2)(b) means withdrawn consent isn't retroactive, it stops future processing, but doesn't undo what was already lawfully done under it.
PopiGuard's Personal Information Register records which of the six lawful bases applies to each thing you collect, so “what's our basis for this?” has a documented answer.
No. Section 11(1) sets out six lawful grounds, and consent is only one of them, the others include performance of a contract, a legal obligation, protecting the data subject's own legitimate interest, a public-law duty, or the responsible party's/a third party's legitimate interest.
Yes, section 11(2)(b) allows withdrawal at any time, though it doesn't undo the lawfulness of processing that already happened before the withdrawal, or processing that rests on one of the other five grounds instead of consent.