{"id":3724,"date":"2026-05-29T09:00:21","date_gmt":"2026-05-29T09:00:21","guid":{"rendered":"https:\/\/itlawco.com\/?p=3724"},"modified":"2026-05-29T09:10:23","modified_gmt":"2026-05-29T09:10:23","slug":"popia-code-of-conduct-gated-access-south-africa","status":"publish","type":"post","link":"https:\/\/itlawco.com\/fr\/popia-code-of-conduct-gated-access-south-africa\/","title":{"rendered":"The POPIA Code of Conduct for Gated Access"},"content":{"rendered":"\n\t\t
<\/div><\/div><\/div>
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\n
\n\t

Why security gates are becoming regulated data systems<\/h2>\n

Security gates used to control movement. Today, they control personal information.<\/p>\n

Every visitor log, licence scan, CCTV recording, biometric reader, and access tag is a form of regulated data processing. The Information Regulator\u2019s draft Code of Conduct for Gated Access\u2014published for comment on 30 April 2026\u2014formalises a major shift: gated environments are no longer just security systems; they are regulated data systems.<\/p>\n

This article explains what the draft Code means, who it affects, the legal risks, how it now stands, and how estates and controlled-access environments should prepare.<\/p>\n

Where the draft Code stands now<\/h2>\n

On 30 April 2026, the Information Regulator published the draft Own Initiative Code of Conduct on the Processing of Personal Information at Gated Accesses in South Africa<\/em><\/a> in Government Gazette No. 54594 (Government Notice No. 7415). It was issued on the Regulator\u2019s own initiative under section 60(1) of POPIA, with the comment notice given under section 61(2).<\/p>\n

The draft is 65 pages. The comment period\u2014initially fourteen days, later extended<\/a>\u2014closed on 29 May 2026. The draft is now with the Regulator, which will consider stakeholder comments before deciding whether to revise the draft and, in due course, issue a final Code.<\/p>\n

\n

An important distinction: the Code has been published as a draft. It is not yet binding. A Code of Conduct issued under section 60 of POPIA becomes binding and enforceable once it is finalised and issued, but this version is a consultation draft, and its content may change before then.<\/p>\n<\/blockquote>\n

ITLawCo filed comments on the draft.<\/strong> Our submission supports the Regulator\u2019s underlying objective (there are real privacy harms at access points, and they are worth addressing) while identifying areas where the draft needs refinement before it is issued. We summarise the three that matter most to controlled-access operators below.<\/p>\n

What is the POPIA Code of Conduct for Gated Access?<\/h2>\n

The Code is a sector-specific regulatory instrument under section 60 of POPIA. It translates the Act’s general principles into operational rules for environments where access is controlled, including:<\/p>\n