Collection directly from data subject
(1) Personal information must be collected directly from the data subject, except as otherwise provided for in subsection (2).
(2) It is not necessary to comply with subsection (1) if— (a) the information is contained in or derived from a public record or has deliberately been made public by the data subject; (b) the data subject or a competent person where the data subject is a child has consented to the collection of the information from another source; (c) collection of the information from another source would not prejudice a legitimate interest of the data subject; (d) collection of the information from another source is necessary— (i) to avoid prejudice to the maintenance of the law by any public body, including the prevention, detection, investigation, prosecution and punishment of offences; (ii) to comply with an obligation imposed by law or to enforce legislation concerning the collection of revenue as defined in section 1 of the South African Revenue Service Act, 1997 (Act No. 34 of 1997); (iii) for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated; (iv) in the interests of national security; or (v) to maintain the legitimate interests of the responsible party or of a third party to whom the information is supplied; (e) compliance would prejudice a lawful purpose of the collection; or (f) compliance is not reasonably practicable in the circumstances of the particular case.
What this means for your estate
- The default is direct collection, if your managing agent or a background-check vendor supplies resident or staff information collected from somewhere else, subsection (2) is what you're relying on, and it's worth knowing which specific ground applies rather than assuming it's automatically fine.
- A tenant referral from a previous body corporate, or a contractor's staff list handed over by a security company, are both “from another source” under this section, the estate receiving the data still needs a subsection (2) ground for accepting it.
PopiGuard's intake tools flag when data is coming from a third party rather than the resident directly, so the right exception gets recorded at the point of collection.