Exclusions
(1) This Act does not apply to the processing of personal information— (a) in the course of a purely personal or household activity; (b) that has been de-identified to the extent that it cannot be re-identified again; (c) by or on behalf of a public body— (i) which involves national security, including activities that are aimed at assisting in the identification of the financing of terrorist and related activities, defence or public safety; or (ii) the purpose of which is the prevention, detection, including assistance in the identification of the proceeds of unlawful activities and the combating of money laundering activities, investigation or proof of offences, the prosecution of offenders or the execution of sentences or security measures, to the extent that adequate safeguards have been established in legislation for the protection of such personal information; (d) by the Cabinet and its committees or the Executive Council of a province; or (e) relating to the judicial functions of a court referred to in section 166 of the Constitution.
(2) ‘‘Terrorist and related activities’’, for purposes of subsection (1)(c), means those activities referred to in section 4 of the Protection of Constitutional Democracy against Terrorist and Related Activities Act, 2004 (Act No. 33 of 2004).
What this means for your estate
- The “purely personal or household activity” exclusion (subsection (1)(a)) is narrow and doesn't cover the estate itself, a resident's private address book is excluded; the body corporate's own resident database, run for scheme administration, is not.
- The de-identification exclusion (subsection (1)(b)) has a genuinely high bar: information only falls outside the Act once it can't be re-identified again, not merely once names have been removed from an otherwise identifiable dataset (a unit number or vehicle registration can still re-identify someone).
- The remaining exclusions, national security, Cabinet, judicial functions, are not going to apply to an estate's day-to-day operations; they're included here for completeness of the Act, not because they're relevant to your compliance work.
If you're ever unsure whether something in your records genuinely qualifies as de-identified, PopiGuard's Policy Vault has the practical test to apply before relying on subsection (1)(b).