The POPI Act / Sections / Section 21
Section 21
Security measures regarding information processed by operator
Chapter 3 · Conditions for Lawful Processing ยท Condition 7, Security Safeguards
(1) A responsible party must, in terms of a written contract between the responsible party and the operator, ensure that the operator which processes personal information for the responsible party establishes and maintains the security measures referred to in section 19.
(2) The operator must notify the responsible party immediately where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person.
Source: justice.gov.za, Protection of Personal Information Act 4 of 2013 (official PDF), cross-checked verbatim before publishing.
Beyond the text
What this means for your estate
- Subsection (1) requires a written contract specifically, a verbal understanding or a general services agreement that doesn't reference s.19's security obligations doesn't satisfy this section, even if the managing agent is in fact being careful with the data.
- Subsection (2) is the operator-side mirror of s.22's breach-notification duty, if your CCTV vendor or managing agent suspects a breach, they're legally required to tell you immediately, which only works if your contract actually says so.
Relevant tool
PopiGuard's operator agreements bake in the s.19 security requirements and the s.21(2) immediate-notification duty, so the paperwork matches what the Act actually requires.