- Members of the public have until 14 May 2026 to submit their comments on the proposed POPIA code for gated access.
- The draft code addresses the use of CCTV surveillance, biometric systems, and the collection of excessive personal information at controlled access points.
- Comments on the proposed code should be emailed directly to the Information Regulator.
The deadline for public comments on the Information Regulator’s proposed Code of Conduct, which governs how personal information is processed at gated access points across South Africa, is approaching fast. Submissions close on 14 May 2026.
Published in the Government Gazette on 30 April 2026, the draft code proposes stricter rules for collecting, processing, storing, and deleting personal information at controlled access points in line with the Protection of Personal Information Act (POPIA).
The proposed code was developed in response to concerns and complaints from the public about intrusive security and access control practices at estates, office parks, commercial buildings, and other gated environments.
According to the Information Regulator, these complaints highlighted worries over excessive collection of personal data, the increasing use of biometric systems like facial recognition and fingerprint scanning, and CCTV surveillance practices that could infringe on privacy rights.
The draft notes that some gated access systems collect personal information that is excessive, not relevant, and not limited to what is necessary for the purpose it is being processed.
Proposed rules for access-controlled environments
The proposed code would apply to a wide range of public and private settings. These include residential estates, sectional title complexes, shopping centres, hotels, office parks, schools, universities, hospitals, clinics, and government buildings.
The Information Regulator says the code aims to strike a balance between security needs and constitutional privacy protections under POPIA. The draft also seeks to standardise lawful access control practices and introduce stronger governance and accountability for organisations processing personal information at gated entrances.
There is particular focus on biometric systems, such as fingerprint verification and facial recognition, which POPIA classifies as special personal information requiring heightened safeguards.
The draft raises concerns that CCTV systems at access points often capture people’s faces without the consent of data subjects and, at times, without their knowledge or awareness.
Excessive information collection questioned
One of the draft code’s key proposals requires organisations to collect only the personal information that is truly necessary and proportionate for access control purposes.
The Information Regulator warns against collecting multiple forms of personal information for routine visitor access when less intrusive alternatives are available.
Examples in the draft include collecting identity numbers, photographs, fingerprints, vehicle registration details, and contact information for ordinary access requests. The proposed code also makes it clear that consent cannot be implied just because a visitor signs an access register.
According to the draft, consent must be informed, voluntary, and explicit. People entering premises should be properly informed about how their information will be used, stored, and retained.
The code also proposes that organisations operating gated access systems appoint Information Officers or Deputy Information Officers who are specifically responsible for POPIA compliance.
Public consultation process underway
The draft code, issued under Section 60(1) of POPIA, is part of broader efforts by the Information Regulator to strengthen privacy protections in South Africa’s increasingly monitored and access-controlled environments.
The Information Regulator invites stakeholders and members of the public to submit written comments on the proposed framework by emailing POPIACompliance@inforegulator.org.za before the closing date.
Get your news on the go. Click here to follow the Conviction WhatsApp channel.
