Privacy and POPIA

POPIA for transfer and tour companies: a practical guide

Every booking holds personal information: names, mobile numbers, flight details, hotels, sometimes passport numbers. The Protection of Personal Information Act (POPIA) sets out how you may collect, use and protect it. Here's what it means in practice for a transfer or tour business.

Tafel guides · 7 minute read

This guide is general information, not legal advice. For advice on your own business, speak to a lawyer or a POPIA specialist.

What personal information you hold

• Guests and passengers: names, mobile numbers, email addresses, flight numbers, pick-up and drop-off addresses, special needs, and sometimes ID or passport numbers.
• Bookers: hotel concierges, travel agents, assistants and their contact details.
• Chauffeurs and staff: ID numbers, driving licences and PrDPs, bank details and, if you track vehicles, where they were.

Under POPIA your company is the responsible party for this information: you decide why and how it's used, and you're accountable for it.

The rules in plain language

POPIA sets eight conditions for lawful processing. For a transfer company they come down to this:

1. Be accountable. Someone in the business is responsible for privacy.
2. Only collect what you need for the trip, and have a lawful reason, such as carrying out the booking.
3. Use it for that purpose. Don't use a guest's number for marketing unless they agreed to it.
4. Keep it accurate and up to date.
5. Be open. Tell people what you collect and why, in a privacy notice on your website and booking form.
6. Keep it safe with reasonable security.
7. Let people see, correct and delete their information.
8. Take care with special information such as health details and children's information.

A practical checklist

Register your Information Officer

By default the head of the business is the Information Officer. Register them with the Information Regulator on its online portal at inforegulator.org.za, and put their contact details in your privacy notice.

Add a privacy notice where you take bookings

On your website, your booking form and your quotes: what you collect, why, who you share it with (for example your chauffeurs and payment provider), how long you keep it, and how to contact your Information Officer.

Get out of WhatsApp groups

Dispatching by WhatsApp group shares every guest's name and number with every chauffeur in the group, often on personal phones that are never wiped. Send each chauffeur only their own jobs, and remove details once the trip is done.

Sign operator agreements with your service providers

Your booking software, email provider and accounting package process personal information for you. POPIA (section 21) requires a written agreement that they keep it secure and confidential. Ask your providers for theirs.

Know where your data is stored

Sending personal information outside South Africa is allowed only with proper protection (section 72). Prefer providers that host in South Africa, or that can show how your data is protected abroad.

Decide how long you keep things

Keep financial records as long as tax law requires, but don't keep guests' contact details forever. Set a period, for example five years, after which names and numbers are removed and only the amounts remain for your accounts.

Be ready for requests and breaches

If a guest asks what you hold about them, you should be able to export it. If personal information is lost or stolen, POPIA (section 22) requires you to tell the Information Regulator and the people affected as soon as reasonably possible.

Why it matters

The Information Regulator can investigate complaints and issue fines of up to R10 million, and serious offences can lead to imprisonment. Just as important: hotels, DMCs and corporate clients increasingly ask their suppliers about POPIA before they sign. Being able to say "yes, here's how" wins work.

Where software helps

A good booking system makes most of this automatic: a privacy notice on the booking form, chauffeurs who only see their own jobs, an audit trail of who saw and changed what, automatic clean-up of old personal details, data hosted in South Africa, and a one-click export when someone asks for their information.