- POPIA already applies to visitor information collected at gated estates and complexes.
- The proposed Code of Conduct would explain how POPIA should be applied at controlled entrances.
- The key issue is not whether a licence is scanned, but whether the collection and retention of information can be justified.
Over the past few months, the ordinary act of handing a driving licence to a security guard has become the subject of increasing media coverage.
South Africa is a unique residential market with thousands of secure housing estates. So the act of interacting with a security guard and handing over personal documents has become standard practice. But is it actually legal?
It is easy to understand why recent media coverage might prompt us to question this. From an interest perspective, millions of South Africans pass through controlled entrances every month, usually handing over personal information without knowing precisely what is being read, what is being stored or how long it will remain in the system. But it is primarily the introduction of a proposed Code of Conduct that has stirred up the conversation.
What is a Code of Conduct?
On 30 April 2026, the Information Regulator published notice of a proposed Own Initiative Code of Conduct on the Processing of Personal Information at Gated Accesses. In short, the Information Regulator has drafted a Code of Conduct on how gated estates must process your information. "Own initiative" is the important part.
Attempts have been made to regulate this space by residential industry bodies, but those carry no standing unless the Regulator acts on them. The Regulator itself wrote this one. Affected parties were invited to comment in writing. That period has now come to an end, and the Draft Code of Conduct may still be revised before the next draft or a final version is issued.
Importantly, the Draft Code of Conduct does not replace POPIA. It takes POPIA's eight conditions for lawful processing and sets out what they look like at any gated access area.
- Who must be accountable and registered.
- What information may be collected, and on what legal justification.
- What people must be told at the point of collection.
- How long records may be kept, how they must be secured, and how they must be deleted.
- How a complaint must be received, handled and escalated.
Some of that is prescriptive. Much of it asks the secure estate or site to make a decision, document it and be able to explain it.
This proposed Code of Conduct matters because of how wide it reaches. Once finalised, it will bind every public or private body on why and how personal information is processed at their controlled entrance.
To answer the title of this article: What information can an estate ask for?
It is important to separate what the proposed Code of Conduct actually restricts from what the public conversation has sometimes suggested it does.
- The Draft Code of Conduct does not state that estates are prohibited from scanning driving licences.
- It does not amend POPIA or create a new privacy law. POPIA has applied to the processing of visitor information for years.
- Nor does it prevent an estate from identifying a visitor, maintaining an access record or taking reasonable measures to protect the people and property behind its gates.
The proposed Code of Conduct performs a different function. It takes the broad legal conditions already contained in POPIA and sets out how the Information Regulator expects them to be implemented in gated-access environments.
The question is not simply whether an estate may scan a driving licence; it is asking every gated access point to validate its need and purpose for processing personal information. The question is what information the estate collects, which parts of that information the estate retains, why each item is necessary, whether a less intrusive method could achieve the same security purpose and, finally, how the purpose of retention is justified and how long the resulting record is kept.
What does the future hold?
The Draft Code of Conduct does offer a picture of what the Information Regulator has in mind, setting out examples of proportionate and excessive collection at the gate. These are illustrations rather than a required process, and an estate that can justify collecting more is not automatically in breach. What they show is the direction the Regulator is pointing.
That is a far more nuanced position than much of the recent coverage has allowed. At a South African estate, the entire issue is compressed into a familiar routine. Access code. Driving licence. Vehicle disc. A few electronic beeps, and the boom lifts.
The exchange takes less than a minute. Most visitors experience it as a minor inconvenience. In legal terms, however, the standard gate check may involve several separate acts of processing: verifying an invitation, establishing a person's identity, reading information from a document, connecting that person to a vehicle and retaining a record of the visit. To the visitor, it is all simply a security check. Under POPIA, the details matter.
The proposed Code of Conduct asks gated properties to understand what happens during that check and to justify the personal information collected and the personal information that remains in their systems after the visitor has driven through.
Importantly, none of this means the familiar routine at the boom gate is going away. What it means is that estates may in future no longer treat "this is private property, we make the rules" as sufficient justification for information collection on its own.
There may be no final timeline for the implementation of a Code of Conduct, but the interesting test, when it eventually lands, will be how estates clearly explain the personal information they collect, why it is necessary and how long they intend to keep it. For now, the public continues to wait on the Information Regulator to see how the proposed Code of Conduct evolves.
One thing is certain: there is a clear intention from the Information Regulator to enforce good practice and specific use-case regulation under POPIA. This attention is currently on gated access, but all industries should be prepared for specific Codes of Conduct enforcing POPIA.
A quick word from My Estate Life
There is a common misconception that the responsibility for collecting personal information falls on the software companies that operate the security scanning devices. However, under POPIA, the responsibility is placed on the responsible party, in this case the estate, for what information it collects and why.
Companies like My Estate Life are called operators under POPIA. They are responsible for the secure collection and retention of the information, operating in accordance with the responsible party's instructions.
My Estate Life is a residential management application and visitor processing software platform that has dominated the residential space over the last decade. With more than 650 estates and 1.4 million visitors processed each month, the company has a well-developed understanding of how the industry operates.
My Estate Life has undertaken an upskilling of its estates on the topic through newsletters and information sharing, encouraging estates to see the benefit of data collection assessments and process refinement rather than the cost.
A change such as the proposed Code of Conduct for Gated Accesses will call on responsible parties and operators alike to work together to ensure compliance.
Get your news on the go. Click here to follow the Conviction WhatsApp channel.
