South African estate agencies

Compliance and data protection for estate agencies.

Identity documents, mandates, financial information and transaction records need protection throughout their use. Here is where estate-agency duties meet practical IT controls, and what evidence those controls can provide.

The regulatory context

Three areas of responsibility.

These duties overlap, but each has its own scope. Protecting information supports the agency's work across them; it does not replace the wider compliance programme.

PPRA and the Property Practitioners Act

Keep the agency's records available.

The Property Practitioners Act 22 of 2019 governs sector duties, including Fidelity Fund certificates and specified records. Section 55 covers documents such as mandates, agreements and mandatory disclosure forms.

Organised storage, controlled access and tested retrieval can support those record duties. They do not establish entitlement to practise or replace professional, trust-account or disclosure obligations.

Property Practitioners Act

FIC Act

Know the client and manage financial-crime risk.

Estate-agent activities within Schedule 1 item 3 bring accountable-institution duties. These include FIC registration, customer due diligence, beneficial-ownership checks, relevant prominent or influential person checks, sanctions controls, monitoring, reporting, training and record keeping.

The agency must implement a risk management and compliance programme (RMCP). The wider category of property practitioners is not automatically identical to item 3; FIC PCC 56 explains the distinction.

FIC estate-agent guidance

POPIA

Use personal information lawfully and protect it.

POPIA addresses the full processing of personal information. Sections 19–22 cover safeguards, operators and security-compromise notification. The agency needs appropriate, reasonable technical and organisational measures and must regularly check their effectiveness.

Privacy notices, lawful processing, Information Officer responsibilities, retention and data-subject rights also need attention. Technology addresses only part of that work.

POPIA text

PAIA, contracts and other applicable duties may also affect the agency. This guide provides general information, not legal advice, certification or a guarantee of compliance. Confirm legal interpretation and applicability with suitably qualified advisers.

Retention and retrieval

The start date matters.

Decide how long each record must remain available before setting backup or archive policies. These periods have different triggers.

Selected record duties to include in the agency's retention schedule
Record category	Period and trigger	Source
Documents specified in PPA section 55(1)	Five years from the date or probable date of the document.	Property Practitioners Act, section 55
FIC business-relationship records	At least five years after the relationship ends.	FIC Act, section 23(a)
FIC concluded-transaction records	At least five years after the transaction is concluded.	FIC Act, section 23(b)
Transaction or activity records giving rise to a section 29 report	At least five years after the report is submitted to the FIC.	FIC Act, section 23(c)

Other duties, investigations or legal holds may require longer retention. POPIA section 14 also limits unnecessary retention. Use an approved schedule and a controlled disposal process; do not delete records simply because they reach five years.

Backup retention is a separate design decision. A short backup cycle may not preserve a required record for its full legal period. Test that authorised staff can locate and reproduce the record in a legible form. See FIC Guidance Note 7B, chapter 3 and PPA section 55.

The office extends beyond the branch

Connect each risk to a control you can check.

A client file may pass through a laptop, a phone, email and a shared folder. The examples below are practical discussion points, not a prescribed statutory checklist or a statement that every service is included.

A phone or laptop is lost

Review encryption, screen locks, supported software and access to agency data. Agree how a lost device is reported and access is revoked.

Evidence to retain: Device register, dated configuration checks and a recorded loss-response procedure.

An email account is taken over

Use individual accounts and suitable multi-factor authentication. Review access and forwarding rules. Verify changed payment details using an independently known contact number.

Evidence to retain: Account and access reviews, recorded exceptions and a payment-verification procedure.

A client file cannot be recovered

Identify the records and Microsoft 365 workloads in scope. Agree backup coverage, retention and recovery priorities, then test a representative restore.

Evidence to retain: Coverage list, backup reports, restore-test results and unresolved exceptions.

A departing agent retains access

Assign an owner to remove accounts, shared links and device access. Transfer business records to authorised agency storage, subject to the approved retention policy.

Evidence to retain: Completed departure checklist, access changes and confirmation that required records remain retrievable.

Records are scattered across personal accounts

Set rules for email, WhatsApp and personal devices. Move required business records into an approved repository and limit access to those who need it.

Evidence to retain: Data-location register, sharing review and a tested record-retrieval process.

Name an owner, a review date and a way to record exceptions for each agreed control. Reports should show what was checked, when, on which systems and what remains unresolved. They demonstrate the recorded activity, not complete regulatory compliance.

When something goes wrong

Have a response process before an incident.

Identify who receives reports, who coordinates containment and evidence preservation, and who advises on notifications. Staff need a known contact for a lost device, suspicious sign-in or exposed client file.

Under POPIA section 22, reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person trigger notification duties. The responsible party must notify the Information Regulator and, subject to the Act's provisions, affected data subjects as soon as reasonably possible after discovery.

An operator must notify the responsible party immediately on the grounds set out in section 21(2). There is no general POPIA 72-hour reporting rule. The Regulator directs security-compromise notifications through its eServices portal.

Read the Regulator's reporting guidance. Keep a record of the incident, actions, notifications and follow-up work. Technical support and the agency's legal notification duties need clearly assigned owners.

Bastion Backups' role

Practical IT support for the controls in scope.

We can discuss backup coverage, recovery planning, security visibility, operational reporting and controlled remote support for the systems your agency uses.

Start with the records and systems you rely on, the people who can access them and your recovery priorities. We can then identify where our supported solutions fit and what needs input from your compliance officer or other advisers.

Before work starts, agree the systems covered, responsibilities, reporting, recovery testing, support arrangements, supplier and storage details, and any costs in writing. Where we process personal information as an operator, the arrangement must address the applicable POPIA duties.

The agency remains responsible for its compliance programme, client-risk decisions, RMCP approval and regulatory submissions. We do not certify an agency's compliance or guarantee that an incident will be prevented.

Explore our supported solutions

Common questions

Decisions to make before selecting a service.

Does buying a backup or security product make an agency compliant?

A product can support particular controls. Compliance also depends on lawful processing, people, procedures, contracts and the agency's regulatory duties. A successful backup report does not establish that a file is complete, a client has passed due diligence or every legal requirement has been met.

Is cloud synchronisation the same as a backup or records archive?

Synchronisation can copy changes and deletions between devices. Recovery options depend on the service and its configuration. A backup provides a separate recovery function; a records archive needs deliberate retention, access and retrieval rules. Check what each service actually covers.

Must every agency record be hosted in South Africa?

There is no useful blanket answer. POPIA section 72 governs transfers of personal information outside South Africa, and the Property Practitioners Act includes a South African address requirement for specified accounting records. Check the record type, storage location, supplier terms and access requirements with your advisers before selecting storage.

Legislation and regulatory guidance

Check the source and its scope.

Content reviewed 15 October 2026.

Property Practitioners Act 22 of 2019 — particularly section 55 on records.
FIC estate-agent sector page — including PCC 56 on which property-practitioner activities fall within item 3.
FIC Guidance Note 7B — issued 3 August 2026, replacing the earlier Guidance Note 7/7A versions; covers due diligence, records and RMCPs.
Protection of Personal Information Act 4 of 2013 — particularly sections 14, 19–22 and 72.
Information Regulator security-compromise fact sheet — reporting roles and process.
NIST Cybersecurity Framework 2.0 — a voluntary reference for the practical control examples.
Microsoft's OneDrive sync explanation — how changes and deletions can propagate.
Standard Bank's guidance on banking-detail scams — independent verification of changed payment details.

Check current FIC and PPRA notices for returns, submission dates and other directives that apply to your agency. This guide does not provide a complete compliance calendar.

Discuss your agency's systems

Start with the client records you need to protect.

Tell us which systems your agency uses and what you need to review. Please do not send identity documents, client files, passwords or access codes with an initial enquiry.

Email us Call +27 83 651 6444