POPIA and Property Searches in South Africa

The Protection of Personal Information Act 4 of 2013 (POPIA) regulates how personal data is processed in South Africa. It came into force in 2020 and applies to anyone — individual, business, or government — who handles personal information of identifiable people.

POPIA also affects the deeds registry and the property-search services that connect to it. But it doesn't make property ownership private; the deeds registry remains a public record under separate legislation. What POPIA does is set guardrails on how the data is processed, particularly for bulk extraction and use of personal information.

The starting point: property ownership is public

The Deeds Registries Act 47 of 1937 establishes the deeds registry as a public record. Anyone can search for and obtain information about ownership of any registered property in South Africa, without needing the owner's consent or a stated reason. This is fundamental to how the property system works — buyers need to verify sellers, lenders need to confirm what they're lending against, conveyancers need to check chain of title, and the State needs a transparent record of land ownership.

POPIA explicitly recognises that some personal information is publicly available through statutory channels and treats it differently from purely private data. Property ownership in the deeds registry falls into this category.

What POPIA changes for property searches

For an individual searching for ownership of one specific property for a specific lawful purpose — buying, renting, neighbour dispute, family inquiry — POPIA imposes essentially no restriction. The deeds registry remains accessible exactly as before. Checking who owns a property is fully legal.

What POPIA does change:

• Bulk processing. Extracting personal data on thousands of property owners systematically — to build a marketing list, a profiling database, or a sale-able dataset — falls within POPIA's scope. The processor must have a lawful basis, must respect the original purpose of the data (property registration, not marketing), and must protect against misuse.
• Profiling. Combining property data with other personal data to build profiles of individuals (their net worth, their property portfolio, their family relationships) crosses into POPIA's automated-processing rules and has stricter requirements.
• Onward transfer. Sharing property-search data with third parties — particularly across borders — needs to meet POPIA's transfer requirements. The original recipient can't freely on-sell the data.
• Retention. Property-search providers can't indefinitely store individual users' searches and the personal data returned. POPIA requires retention periods aligned to the purpose for which the data was collected.
• Security. Anyone processing personal data — including property-search providers like DeedsCheck — must protect it from unauthorised access, breaches, or accidental disclosure.

How DeedsCheck handles POPIA

DeedsCheck operates as a responsible party under POPIA for the personal data of its users (subscribers, account holders, search initiators) and as a processor / on-passer for the property-ownership data returned to those users. The key elements:

• Lawful basis. User searches are processed on the lawful basis of contract (delivering the requested report) and legitimate interest (the user's stated purpose of property due diligence).
• Purpose limitation. Search data is used to deliver the requested report and isn't repurposed for unrelated activities without consent.
• Data minimisation. Only the personal data needed for the requested search is processed; no unnecessary additional data is collected.
• Security. Reports are delivered through encrypted channels; user account data is protected with industry-standard security practices.
• User rights. Users can request access to their personal data, correction of inaccuracies, and deletion subject to legal retention requirements.
• No bulk on-sale. DeedsCheck doesn't sell or transfer personal data extracted from property searches to third parties for marketing or profiling.

What's masked vs what's shown

Some sensitive identifiers in DeedsCheck reports are partially masked in preview or summary views to protect against incidental exposure:

• Full ID numbers are shown in the paid report; preview views show only partial or masked versions.
• Some personal contact information (if available from auxiliary data sources) is held back or aggregated.
• The order reference required to access a specific report acts as a single-use credential — only the person who paid for the report can retrieve it.

This balances the public nature of deeds-registry data with practical POPIA prudence: full data flows to the paid user with a clear lawful purpose, while ambient interfaces don't casually expose personal identifiers.

What you can legally do with a property report

The report is for your use to address the purpose you stated when you bought it. You can:

• Use it for your own decision-making (buying, renting, dispute resolution, etc.)
• Share it with your conveyancer, attorney, bank, or estate agent — anyone with a legitimate role in the matter you're investigating
• Submit it as evidence in legal proceedings where relevant
• Retain it for your records as long as needed for the original purpose

What you should not do with the report:

• Publish the personal information on social media, websites, or forums where it identifies the owner
• Use it to build profiles for marketing or commercial targeting of individuals
• Combine it with other data to create derivative products that you sell or share
• Use it to harass, defame, or unfairly disadvantage the owner
• Process it in any way unrelated to the original purpose you stated

These constraints flow from POPIA's general principles. The deeds-registry data remains public, but personal information processing is regulated regardless of the source.

The Information Regulator

POPIA is enforced by the Information Regulator of South Africa. Complaints about misuse of personal data — including property-related data — can be made to the Regulator at inforegulator.org.za. Penalties for POPIA breaches can include administrative fines and, in serious cases, criminal sanctions.

POPIA in summary

Practically:

• You can still legally look up ownership of any registered property in South Africa
• You don't need the owner's consent for an individual lookup for a legitimate purpose
• You shouldn't republish personal data or use it for purposes outside what you stated
• Bulk extraction and profiling have stricter requirements
• DeedsCheck and any other service provider operates with POPIA compliance built in

Frequently asked questions

Did POPIA make property ownership private?

No. The deeds registry remains a public record. POPIA regulates how personal data is processed but doesn't override the public nature of property registration.

Do I need to register with the Information Regulator to do property searches?

Not for individual searches. Registration with the Regulator applies to organisations processing personal data at scale or in specific regulated capacities, not to individuals running an occasional property lookup.

Can I post a property report on social media?

Publishing personal information (owner name, ID number, transfer details linked to a named individual) on social media without the owner's consent could breach POPIA. Sharing the report with your conveyancer or attorney is fine; broadcasting it isn't.

What about commercial use of property data — running a property newsletter, a podcast, a research paper?

Depends. Aggregated, suburb-level, or anonymised data is generally fine. Naming specific individuals and their property holdings in commercial publications can fall foul of POPIA without proper consent and lawful basis. Get advice if in doubt.

What if my own information appears in a report?

Your registered ownership of property is a matter of public record under the Deeds Registries Act and you can't opt out of being included in the registry itself. You can, however, exercise POPIA rights against specific processors who handle that data inappropriately — request access to what they hold, correction of errors, and deletion where they're processing beyond what's lawful.