What the POPIA Act asks of a South African brokerage: the eight conditions for lawful processing, a practical check for each, and WhatsApp examples.
The Protection of Personal Information Act (POPIA) sets eight conditions that every brokerage must meet whenever it collects, stores, uses, shares or deletes a client's personal information. Section 4 of the Act lists them: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. For a broker, that covers almost everything in the office: the needs analysis, the ID copy, the medical questions on a life application, the claim photos a client sends on WhatsApp, and the spreadsheet a new adviser keeps "just for follow-ups".
This guide takes the conditions one at a time and translates each into what a small or mid-sized South African brokerage actually has to do, what evidence to keep, and where WhatsApp makes it easier or harder. It is not legal advice; the Act itself, published by the South African Government, and the Information Regulator remain the reference.
POPIA speaks of a "responsible party": the person or business that decides why and how personal information is processed. For the client files it holds, the brokerage is a responsible party in its own right, alongside the insurers it places business with. Your software vendors, your cloud hosting and your messaging provider are usually "operators": they process on your instructions, and you remain answerable for them. We cover operator contracts and cross-border hosting in a separate guide on vetting AI and software vendors under POPIA.
Every private body also has an information officer. The Regulator's site states that information officers may assume their duties only after the responsible party has registered them with the Regulator through its portal. If nobody in the brokerage can say who that person is, start there.
| Condition | Sections | What it means for a broker | Evidence to keep |
|---|---|---|---|
| 1. Accountability | 8 | The brokerage, not the individual adviser, answers for compliance with all the other conditions. | Named, registered information officer; a written POPIA policy; a record of who approved it. |
| 2. Processing limitation | 9 to 12 | Collect only what the advice or the policy needs, on a lawful basis, preferably from the client directly. | Needs-analysis templates without "nice to have" fields; consent wording where consent is the basis. |
| 3. Purpose specification | 13 to 14 | Know why each piece of information is collected, and keep it no longer than that purpose (or another law) requires. | A retention schedule per record type; a deletion or de-identification routine. |
| 4. Further processing limitation | 15 | A new use must be compatible with the original purpose. | A short note whenever client data is reused for a campaign, a book sale or an analysis. |
| 5. Information quality | 16 | Keep details complete, accurate and up to date. | Periodic contact-detail checks; a way to log corrections. |
| 6. Openness | 17 to 18 | Document processing and tell clients what you collect, why, who receives it and what their rights are. | Privacy notice given at onboarding; processing documentation. |
| 7. Security safeguards | 19 to 22 | Protect the information, bind your operators, and notify breaches. | Access list, operator agreements, incident log, breach notification template. |
| 8. Data subject participation | 23 to 25 | Clients may ask what you hold on them and ask for corrections. | A request log and a way to export one client's full file, conversations included. |
Accountability is the condition that makes the other seven someone's job. In practice: name the information officer, register them, write a short policy that says how the brokerage meets each condition, and review it when something changes (a new system, a new product line, an acquired book). An adviser who keeps client chats on a personal phone is not a personal risk; under this condition it is the brokerage's.
Processing must be lawful and minimal. A broker usually relies on the need to conclude or perform the client's contract, on legal obligations such as FAIS and FICA, and sometimes on consent. Minimality is where most files fail: ID numbers copied into three systems, full bank statements kept when a debit order mandate was all that was needed, medical detail forwarded to colleagues who do not handle the application. Health information is also "special personal information" under section 26, which prohibits processing unless an authorisation applies; section 32 authorises insurers and medical schemes in defined cases, so check which basis your own handling rests on, and limit who in the brokerage sees it.
Each record needs a purpose and a retention period. Section 14 allows longer retention where a law requires it, where it is reasonably needed for a lawful purpose, where a contract requires it, or with consent; afterwards the record must be destroyed, deleted or de-identified. Your FAIS record-keeping duties are one of those laws, which is why WhatsApp conversations that contain advice belong in the archive rather than on a handset. The mistake runs both ways: deleting what FAIS requires, and keeping declined quotes and lapsed prospects forever "in case".
Using renewal data to remind a client of their renewal is the same purpose. Using a motor client's details to market funeral cover is a new one, and electronic direct marketing carries its own rules in section 69, which we explain in POPIA consent rules for WhatsApp marketing. Before any new use of the book (a campaign, a scoring model, a sale of the practice), write down why it is compatible with what the client was told.
Wrong numbers are a POPIA problem as well as a service one: a renewal notice sent to a number the client gave up reaches a stranger. Build a light correction habit into existing contact points, for example a confirmation question on the annual review, and record the change.
Section 18 lists what the client must be made aware of when you collect their information: what is collected, who you are, the purpose, whether supplying it is voluntary or mandatory and the consequences of not supplying it, recipients, any transfer abroad, and their rights, including the right to complain to the Regulator. Put this in a privacy notice given at onboarding and link it in the first WhatsApp message to a new client.
Security means reasonable technical and organisational measures: who can open which client file, how devices are locked, what happens when an adviser leaves. It also covers operators: you need a written agreement requiring them to keep appropriate safeguards. And under section 22, when you have reasonable grounds to believe personal information was accessed by an unauthorised person, you must notify the Regulator and the affected clients as soon as reasonably possible, with the possible consequences, the measures taken and what the client can do to protect themselves. A stolen phone holding client chats, or a hijacked WhatsApp account, is exactly this case.
A client may ask whether you hold information about them, ask for a description of it, and ask for correction or deletion. If advice, claim updates and documents are spread across personal phones and inboxes, answering fully is close to impossible. Keep one file per client that includes the conversations.
A few realistic messages that apply the openness and participation conditions without legal jargon:
Hi {first_name}, welcome to {firm}. We will use this number for your policy admin, renewals and claims. How we handle your personal information, and your rights, are here: {privacy_link}. Reply STOP at any time if you no longer want messages from us on WhatsApp.
Hi {first_name}, before your annual review: is this still the best number and email for you? A quick yes, or your new details, is enough. — {adviser}, {firm}
Hi {first_name}, we have received your request for a copy of the information we hold about you. Our information officer is handling it and will come back to you on this number. — {firm}
No software makes a brokerage POPIA-compliant; the conditions are about decisions and habits. A shared WhatsApp inbox does remove some of the hardest gaps. In ORIS, conversations sit on a business number the brokerage controls, attached to the client in Customers & Segments. Campaigns go only to clients with a WhatsApp opt-in, and consent is checked again at the moment of sending. A STOP reply, typed or tapped, also cancels messages already queued. Settings include audit logs, and customer data can be exported to CSV when a client asks what you hold. The policy, the retention decisions and the Regulator registration remain yours. More on the regulatory side: our South Africa broker guide.
Accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. Section 4 of the Act lists them and points to the sections that detail each one.
Yes. The Act applies to any responsible party that processes personal information entered in a record in South Africa, with limited exclusions; there is no general exemption based on the size of the business.
No. Consent is one lawful basis among several. Servicing an existing policy usually rests on the contract and on legal duties. Consent matters most for unsolicited electronic direct marketing and for some special personal information.
The Regulator can investigate, issue enforcement notices and, under section 109, impose an administrative fine of up to R10 million. Clients can also complain to the Regulator, and some offences carry criminal penalties.
If there are reasonable grounds to believe someone unauthorised accessed client personal information, for example through a hijacked account or a lost unlocked phone, section 22 requires notification to the Regulator and to the affected clients as soon as reasonably possible.
Shared WhatsApp inbox, client records, follow-ups and opportunities for the whole brokerage. 15-minute demo.
Collect the opt-in, send the welcome message, set the rules of the channel and check in at 30 days: the onboarding journey for a new brokerage client.
ID, licence, bank details, claims history: how a brokerage requests, checks and files the documents clients send on WhatsApp, within FICA and POPIA rules.
Advisers answering clients on their own WhatsApp: speed against lost history, POPIA, FAIS and FCA records. When it is acceptable and how to migrate.
How the FAIS Ombud works for a South African brokerage: what it can hear, how a complaint moves to a determination, and the file you must produce.
Check your name on the FSCA register: where the FAIS search sits, searching by ID number or FSP number, reading the result and fixing a wrong entry.
The RE5 exam for South African brokerages: who must write it, the two-year deadline, the eight tasks tested, the 33 out of 50 pass mark and a study plan.
