Privacy, POPIA and security
POPIA and security for a scheme's records
A scheme's register, votes and complaints are personal information about its owners and residents. Estate Manager protects them with two-factor sign-in, keeps each estate's data apart from every other's, and gives every person a privacy centre built for the Protection of Personal Information Act (POPIA). The body corporate stays in charge of its records.
Who is responsible for what
The body corporate decides, and Nanotech processes for it
POPIA gives each party its own duties.
The body corporate
It decides why and how its owners' and residents' information is used, so it is the responsible party for its records. Its managers decide who sees what, and its Information Officer answers requests about them.
POPIA s1Nanotech Computers
Nanotech processes each estate's records as its operator, and section 21 requires a written agreement between them that binds Nanotech to the security measures of section 19 and to tell the estate immediately of any compromise. It uses them only with the scheme's authority and keeps them confidential. Nanotech's own administrators of Estate Manager can see and administer every estate, to run and support the service.
POPIA s20 and s21Every person who signs in
Each person accepts the privacy notice before reaching an estate, downloads what is kept about them and corrects their own details.
POPIA s18 and s23Signing in
Two-factor sign-in for everyone who manages an estate
The chair, the trustees and the managing agent add an authenticator app at their next sign-in, before they can continue, because they see and change other people's information. A stolen password alone does not reach the estate's records. Any owner may turn two-factor sign-in on too, and one-time recovery codes cover a lost phone.
Estate Manager runs its own sign-in server rather than a third party's. An account signs in only once its email address is confirmed, repeated attempts are slowed down, and three wrong passwords lock the account for 5 minutes.
Isolation and hosting
Each estate's data kept apart, and hosted in the EU
Every estate's records are isolated from every other estate's by row-level security in the database, behind the application's own checks. The application connects as a database role that the policies bind, so a query that lost its filter still sees only its own estate. Automated tests check that a request for one estate cannot read or change another's records.
Estate Manager is hosted on Amazon Web Services in a European Union region from launch. For a South African scheme, that is a transfer of personal information outside the Republic, which section 72 of POPIA allows where the recipient is subject to a law that gives an adequate level of protection. The privacy notice discloses the transfer and its basis.
A managing agent switches estates without signing in again Emails go through a provider that the privacy notice names
The privacy centre
A privacy centre for every person
Every user accepts the privacy notice when they register, and again at their next sign-in when a new version takes effect. Each person downloads what Estate Manager keeps about them in their account and their estates' records as machine-readable files, asking the estate for what the download leaves out, such as complaints others filed about their unit, sees when lists holding their details were read and by which role, and corrects their own details.
When an owner sells and leaves, the managers close their account. Where the scheme must keep its records of meetings and votes, the person's account is anonymised rather than deleted, so the votes still count and the account no longer carries the name, though records the scheme keeps in its own right, such as the owner register and the attendance registers of its meetings, may still name them. The managers can also download a template of the estate's own privacy notice to residents, to complete with a legal adviser.
The audit trail
An append-only audit trail the trustees can read
Every change in an estate is written to an audit trail, and so is each read of the register, the members, the invitations, the complaints and the requests, among other records that hold people's details. The database itself refuses any change to it or deletion from it, outside the retention schedule. Entries name records by their ids rather than by people's details, and the trustees read the trail to oversee the managing agent on the owners' behalf.
Nothing kept longer than needed
Many kinds of record have a retention period, and a daily job deletes what has reached the end of it, or removes from it the details that identify a person, as section 14 of POPIA asks. Others, such as the register, the meetings and the library, stay until the managers delete them. Some of the periods:
| Record | Kept for |
|---|---|
| The audit trail | 5 years from each entry |
| Complaints resolved or dismissed | 5 years from the outcome |
| Requests completed or declined | 5 years from the outcome |
| Quote requests closed, declined or withdrawn | 6 years from closing |
| Budgets superseded, withdrawn or not approved | 6 years |
| Emails in the outbox | 90 days |
| Documents a manager deleted | 90 days, then gone with every version |
| Proof of delivery of a meeting's notice | As long as the scheme keeps the meeting's records |
The full schedule is on the application's legal page, open to anyone.
If something goes wrong
What happens after a security compromise
When there are reasonable grounds to believe that someone without authority has accessed or acquired personal information, these are the steps.
- 01
Contain
We stop the access, secure the evidence and find out what happened.
- 02
Tell the estate
We tell each estate whose records are affected immediately, as section 21(2) requires.
POPIA s21(2) - 03
Help it notify
The body corporate, as the responsible party, notifies the Information Regulator and the people affected as soon as reasonably possible. We give it the facts it needs.
POPIA s22 - 04
Our own records
For information Nanotech is itself responsible for, such as sign-in accounts, we notify the Regulator and the people affected ourselves.
POPIA s22 - 05
Fix and review
We restore the service, fix the cause and update our safeguards.
POPIA s19(2)
What the law says
POPIA and sectional title schemes: the points that matter
The Protection of Personal Information Act 4 of 2013 sets eight conditions for lawful processing (section 4), and section 16 of the practice directive of the Community Schemes Ombud Service (CSOS) applies them to community schemes.
General information, not legal advice.
Responsible party and operator
The body corporate determines why and how its members' information is processed, so it is the responsible party. A provider that processes the information for it under a contract is an operator, and the scheme must have an operator's agreement with it.
Security safeguards
The responsible party takes appropriate, reasonable technical and organisational measures against loss, damage and unlawful access. It identifies the risks, maintains safeguards against them, checks that they work and updates them.
The operator's duties
An operator processes the information only with the responsible party's knowledge or authorisation and keeps it confidential. A written contract requires it to maintain the section 19 measures, and it tells the responsible party immediately of any unauthorised access.
Security compromises
The responsible party notifies the Information Regulator and the people affected as soon as reasonably possible, in writing, with enough detail for them to protect themselves. The Regulator asks for reports through its eServices portal.
Retention
Records are kept no longer than their purpose needs, unless a law requires or authorises it, the responsible party reasonably needs them, a contract requires it or the person consents. Then they are destroyed, deleted or de-identified.
Openness and access
People are told what is collected, why, by whom and where it goes, including any transfer abroad. They may ask what is held about them and who has had access to it, and ask for corrections or deletion.
The Information Officer
Each scheme designates an Information Officer, who may take up the duties only once registered with the Information Regulator.
Questions
Questions about POPIA and security
Anything else: ask us when you book a demo, or write to info@nanotech-computers.com.
What is POPIA, and what does it stand for?
Does POPIA apply to a body corporate?
Who is a body corporate's Information Officer?
Is Estate Manager POPIA compliant?
Can we take our records with us?
Does Estate Manager send marketing to owners?
Related
Related
See how a scheme's records are protected
A demo shows the privacy centre, the audit trail and two-factor sign-in on a fictional scheme, with time for your questions about how records are kept.