South Africa Moves to Tighten Privacy Rules for Visitor ID Scans at Gated Properties

Security guards, reception staff and access control personnel at South Africa’s estates, office parks and gated communities could soon face stricter obligations when handling visitors’ personal information under proposed changes to the country’s data protection framework.

The changes stem from a draft code of conduct issued under the Protection of Personal Information Act (POPIA), which seeks to regulate how personal information is collected, processed and stored at gated access points. Legal experts say the measures would classify security guards and other frontline access-control personnel as data processors, placing greater responsibility on organisations to ensure they handle personal information lawfully.

The proposed framework comes amid growing concern over the widespread practice of scanning visitors’ driving licences when entering residential estates and commercial office parks. A barcode scan can reveal significantly more information than is visible on the face of the licence, including a person’s identity number, date of birth, licence details and, in some cases, sensitive information linked to driving restrictions. Privacy specialists argue that collecting and storing such data may exceed what is necessary for routine access control.

According to legal practitioners, many security personnel currently performing access-control duties have received little or no formal training on POPIA’s requirements, including data minimisation, retention periods, deletion protocols and privacy notices. The proposed code aims to address these gaps by introducing sector-specific standards for organisations responsible for processing visitor information.

If adopted, the new rules would require estates, office parks and security service providers to review their access-control procedures, ensure that only information necessary for legitimate security purposes is collected, and strengthen safeguards around the storage, retention and disposal of personal data.

The proposed measures form part of South Africa’s broader efforts to strengthen privacy protections and improve compliance with POPIA as the Information Regulator increases scrutiny of how organisations collect and process personal information.

Compliance Takeaway….

The proposed changes reinforce the importance of embedding privacy-by-design principles into everyday operations, particularly where organisations collect visitor information. Businesses should review whether personal data collected for access control is adequate, relevant and limited to what is necessary, while ensuring appropriate retention, security and disposal measures are in place. Regular staff training is also essential, as frontline personnel handling personal information must understand their responsibilities under data protection laws.

For compliance teams, the draft code serves as a reminder that third-party security providers and reception staff are part of an organisation’s broader compliance ecosystem. Clear governance, contractual oversight and periodic audits can help ensure that visitor management practices align with legal requirements and reduce the risk of privacy breaches, regulatory action and reputational damage.