The POPI Act / Sections / Section 20
Section 20
Information processed by operator or person acting under authority
Chapter 3 · Conditions for Lawful Processing · Condition 7, Security Safeguards
An operator or anyone processing personal information on behalf of a responsible party or an operator, must— (a) process such information only with the knowledge or authorisation of the responsible party; and (b) treat personal information which comes to their knowledge as confidential and must not disclose it, unless required by law or in the course of the proper performance of their duties.
Source: justice.gov.za, Protection of Personal Information Act 4 of 2013 (official PDF), cross-checked verbatim before publishing.
Beyond the text
What this means for your estate
- This is the section that governs your managing agent directly, if they process resident data on your behalf, subsection (a) means they can't go beyond what the estate has actually authorised, even if it seems like a reasonable extension of their job.
- Subsection (b)'s confidentiality duty applies to anyone with access, not just the named operator, a managing agent's own staff or subcontractors inherit the same obligation.
Relevant tool
PopiGuard tracks which operators (managing agents, CCTV vendors, payment processors) are authorised for what, so “who's allowed to touch this data” has a clear answer.