POPIA basics for estate agency websites and WhatsApp

A plain-language overview of what POPIA means for estate agency websites, enquiry forms and WhatsApp, with a practical checklist. Not legal advice.

Estate agencies handle a lot of personal information: names, phone numbers, email addresses, ID numbers and details about people's homes and finances. The Protection of Personal Information Act (POPIA) sets out how that information must be handled. This guide covers the basics for your website, enquiry forms and WhatsApp.

This is a general overview, not legal advice. Speak to a legal adviser about your agency's specific obligations.

The principle: collect only what you need, for a clear reason

POPIA sets conditions for processing personal information lawfully. In practice, that means being clear about why you collect information, collecting only what you need for that purpose, keeping it accurate and secure, and letting people see or correct what you hold about them.

Your website's enquiry forms

• Ask only for what you need to respond, such as name, phone, email and a message
• Say what you'll use the details for, close to the submit button
• Link to a privacy notice that explains how you handle personal information
• Don't sign people up for newsletters or marketing without separate consent
• Store enquiries securely, with access limited to the people who need it

Direct marketing needs consent

POPIA restricts direct marketing by electronic communication, such as email, SMS and WhatsApp. Generally, you need a person's consent, unless they're an existing client and you're marketing similar services, and they must be able to opt out easily. Keep a record of when and how people agreed.

WhatsApp and personal devices

• Use business accounts rather than agents' personal numbers where possible
• Don't forward clients' details to people who don't need them
• Think about what happens to chats when an agent leaves the agency
• Be careful with screenshots and documents shared in chats

Keep information secure

Use secure hosting with SSL, strong passwords and access controls for your dashboard, and back up data regularly. If personal information is lost or accessed without permission, POPIA requires you to notify the Information Regulator and the people affected.

Appoint an information officer

Every organisation has an information officer, by default the head of the business, who is responsible for POPIA compliance. Information officers must be registered with the Information Regulator.

A practical checklist

1. 1List the personal information you collect on your website, by email and on WhatsApp.
2. 2Remove any form fields you don't need.
3. 3Publish a clear privacy notice and link to it from every form.
4. 4Separate enquiry consent from marketing consent.
5. 5Limit dashboard access and review it when staff leave.
6. 6Confirm your information officer is registered with the Information Regulator.

Our real estate websites collect only what's needed to respond to an enquiry, don't add people to mailing lists, and keep enquiries in a secure dashboard with staff-only access.