Personal Information in an OTP: What POPIA Actually Requires of Property Practitioners

Every OTP generates a trail of personal information: ID numbers, FICA documents, banking details, sometimes financial history. That information doesn't stay with one party, it moves through conveyancers, bond originators, financial institutions, and more. POPIA doesn't prevent this, but it does require that the processing be lawful, consented to, and limited to what's actually necessary. This instalment covers what the clause needs to include to get that right.

Define the Act you're relying on

Start by naming the Act properly: the Protection of Personal Information Act 4 of 2013, as amended. This sounds like a formality, but it matters if the clause is ever tested, because it fixes exactly which piece of legislation the parties' consent and the practitioner's obligations are tied to.

State the purpose for processing, and keep it narrow

The clause should authorise the property practitioner to collect, process, use, store and share personal information, but only to the extent reasonably necessary to negotiate, conclude, administer and give effect to the agreement. This isn't just good drafting, it reflects POPIA's own requirement that processing be limited to a defined, legitimate purpose. A clause that authorises processing generally, without tying it to the transaction, goes further than the Act allows.

Name who the information can go to

Vague authorisation to “share information as necessary” isn't good enough. List the categories of recipients: conveyancing attorneys, bond attorneys, bond originators, financial institutions, insurers, valuers, municipalities, managing agents, compliance service providers, and any other party reasonably necessary to complete the transaction. This gives both the seller and purchaser a clear picture of where their information is actually going, which is the point of consent under POPIA, not just a signature on a page.

Get consent to provide accurate information

The seller and purchaser should consent to providing the information and documentation required, and warrant that what they provide is true, accurate and complete. This protects the practitioner and every other party in the chain if a transaction later runs into trouble over information that turns out to have been false or incomplete.

Put the practitioner's obligations in writing too

Consent from the seller and purchaser is only half of it. The clause should also record the practitioner's own undertaking to process personal information in accordance with POPIA and to take reasonable steps to protect it against unauthorised access, loss, misuse or disclosure. This isn't just fair drafting, it's the kind of provision that shows the practitioner turned their mind to their own compliance obligations, not just the client's consent.

Tie it back to why the clause exists at all

Finally, the clause should record that the practitioner can't actually do the job, negotiating, concluding, and administering the sale, without processing and sharing this information. That context matters, because it shows the processing is necessary for performance of the agreement, not incidental to it. Consent given against that backdrop is on firmer ground than a generic tick-box.

Final thoughts

A POPIA clause in an OTP isn't there to satisfy a checklist. It's there because a property sale genuinely can't happen without personal information moving between multiple parties, and POPIA requires that movement to be consented to, purpose-bound, and protected. Leave the clause out, or leave it vague, and you're relying on implied consent to cover a process that the Act expects to be explicit.

Example clause

THE PROTECTION OF PERSONAL INFORMATION ACT

For the purposes of this Agreement, the POPI Act means the Protection of Personal Information Act 4 of 2013, as amended from time to time.

The SELLER and PURCHASER acknowledge and agree that:

The PROPERTY PRACTITIONER may collect, process, use, store and share the personal information of the SELLER and PURCHASER to the extent reasonably necessary to negotiate, conclude, administer and give effect to this Agreement.

The PROPERTY PRACTITIONER may disclose such personal information to any party directly involved in the transaction, including the conveyancing attorneys, bond attorneys, bond originators, financial institutions, insurers, valuers, municipalities, managing agents, compliance service providers and any other person or entity whose involvement is reasonably necessary to complete the transaction.

The SELLER and PURCHASER consent to providing all personal information and supporting documentation reasonably required for the performance of this Agreement and warrant that any information provided is true, accurate and complete.

The PROPERTY PRACTITIONER undertakes to process all personal information in accordance with the POPI Act and to take reasonable steps to ensure that such information is protected against unauthorised access, loss, misuse or disclosure.

The SELLER and PURCHASER acknowledge that the PROPERTY PRACTITIONER cannot fulfil its obligations under this Agreement without processing and sharing personal information as contemplated in this clause and accordingly consent to such processing for the purposes of this transaction.