# POPIA compliance in lease insurance: what landlords need to know URL: https://www.leasesurance.co/blog/popia-compliance-in-lease-insurance Title: POPIA compliance in lease insurance Summary: How tenant data is handled in a lease insurance programme, who can see it, and which parts of POPIA apply once you roll it out across a rental portfolio. --- [← Back to Blog](https://www.leasesurance.co/blog) Research **LeaseSurance** · May 2026 · 5 min read Tenant data starts leaving the landlord's systems the day a lease insurance programme goes live. Someone has to answer for what happens to it after that, and the question usually lands with a compliance officer or an investment committee. This is how LeaseSurance handles personal information under POPIA (Protection of Personal Information Act), and what a landlord should expect to see in writing before the first record moves. ## What Data Is Shared and Why {#what-data-is-shared-and-why} Administering a policy takes five things: identification, lease terms, rental amounts, payment history and property details. Each one does a job. Identification and lease terms establish who is covered and for how long. Rental amounts set the cover multiple. Payment history feeds underwriting and, later, the assessment of a claim. Property details tie the policy to a unit. Nothing outside that list is collected. Where a landlord already runs an integrated property management system, records arrive through that feed instead of being exported and re-keyed by hand. Fewer people touch the data on the way. Our note on [how tenant records move from a property management system into LeaseSurance](https://www.leasesurance.co/blog/how-pms-integration-works-with-leasesurance) covers the mechanics. No tenant data goes to third parties outside the insurance structure. Inside it the parties are the ones a landlord would expect: LeaseSurance as binder holder and administrator under FSP 55633, and Guardrisk Insurance Company Limited (FSP 75) as the insurer. [The licensing and cell captive structure behind the cover](https://www.leasesurance.co/risk-governance#popia-compliance) sets out who those parties are and what each is licensed to do. ## The Legal Framework {#the-legal-framework} POPIA requires personal information to be processed lawfully, for a purpose defined up front, and only as far as that purpose needs. Section 11 sets out the lawful bases a responsible party may rely on. The Act also splits two roles. The responsible party decides why and how information is processed. The operator processes it on the responsible party's instruction and does nothing else with it. The duties attached to each are different, so every LeaseSurance programme records which side holds which role before any data moves. The contracting entity on our side is The LeaseSurance Agent (Pty) Ltd, registration 2020/763628/07. That split sits inside a formal data processing agreement. The agreement states what is collected, the lawful basis for each purpose, where the information is stored, who may reach it, and how long it is kept. Where an operator holds information on servers outside South Africa, section 72 governs the transfer and the agreement names the basis relied on. Retention is not open-ended, but it is not short either. Record-keeping obligations under FAIS (Financial Advisory and Intermediary Services Act 37 of 2002), the Insurance Act 18 of 2017 and the Financial Intelligence Centre Act 38 of 2001 apply to us as a licensed financial services provider, and they run for a minimum of five years after a relationship ends. Information held for that reason is access-restricted and used only for that reason. Tenants keep their rights throughout. They can ask what is held about them and request a record of it under sections 23 and 24, have inaccurate or excessive information corrected or deleted, object to processing under section 11(3), and complain to the Information Regulator. Requests go to our Information Officer and are answered within the period POPIA prescribes. ## Security Measures {#security-measures} Section 19 of POPIA sets the standard: appropriate, reasonable technical and organisational measures. In practice that means data encrypted in transit and at rest, role-based access granted on a least-privilege basis, and an audit trail on every access and processing event. Controls are reviewed on a schedule rather than after an incident. The same controls apply to [LeaseHub™, the platform landlords and property managers work in](https://www.leasesurance.co/leasehub). Access is scoped by role, and every view is logged. If a compromise occurs and there are reasonable grounds to believe personal information has been accessed by an unauthorised person, section 22 requires notification to the people affected and to the Information Regulator. That obligation is written into the processing agreement. ## Why This Matters for Institutional Landlords {#why-this-matters-for-institutional-landlords} A large portfolio moves a great deal of personal information, and the landlord is usually the responsible party for it. Responsibility does not transfer with the data. Section 21 requires the responsible party to hold a written contract with its operator and to satisfy itself that the operator maintains the required security measures. Appointing a provider does not move the obligation, and it does not move the reputational cost either. So the questions worth putting to a lease insurance provider are narrow ones. Who is the responsible party and who is the operator? Where is the data stored, and on what basis if it leaves the country? How long are records kept, and why? What happens when something goes wrong, and how quickly? LeaseSurance answers those in the data processing agreement rather than in a brochure. If your governance process needs the underlying detail, ask for the agreement and the licensing detail before a portfolio is committed. ### About LeaseSurance {#about-leasesurance} LeaseSurance provides deposit-free lease insurance for residential and commercial portfolios across South Africa. [Speak to Us](https://www.leasesurance.co/contact)