Blog

A single booking can pass through a reservations platform and a payment gateway, often with an overseas cloud provider behind them, before the guest has arrived. Guests rarely see those hand-offs. They hold the business they booked with accountable for every one of them, and in many cases so does the Protection of Personal Information Act (POPIA).

POPIA requires businesses to understand how guest information is used, protect it and manage the risks created by sharing it. The sections below follow guest information along its path through suppliers and systems, and set out what the Act expects at each stage.

Know Who Handles Guest Information

Understanding who handles guest information from enquiry to check-out and beyond is a critical first step. Identify what personal information is collected, why it is needed, who receives it, where it is stored and when it should be deleted. Remember to include every point where guest information flows – from booking platforms to payment providers, marketing systems and records shared through email or messaging apps.

Once that picture is clear, establish the role that each party plays. Under POPIA, a “responsible party” is any public or private body, or person, that decides – alone or with others – why and how personal information is processed. A supplier processing information on the business’s behalf may be an “operator”. However, a booking platform using that same information for its own purposes may be a separate responsible party. Be sure to check the actual arrangement before deciding which agreement is needed.

Put Clear Obligations in Supplier Contracts

Sections 20 and 21 of POPIA require operators to process guest information only as authorised and to keep it confidential. They also place a duty on the responsible party to ensure, through a written contract, that the operator maintains the security measures required by Section 19. A general confidentiality clause falls short of this.

A sound agreement starts with scope. It sets out which guest information the supplier may use and for which services, so that any reuse beyond that is clearly unauthorised. For example, a marketing provider should not reuse a hotel’s guest list for unrelated advertising. The agreement should also explain how the provider will honour marketing objections. The agreement should be equally clear about which of the supplier’s staff may access the information and the confidentiality duties that bind them.

Where a supplier relies on subcontractors or processes information outside of South Africa, the agreement should require the security measures that bind the supplier to apply to those arrangements too, including any onward sharing.

The agreement also needs to anticipate incidents and the end of the relationship. If guest information is compromised, the business can only meet its own notification duties when the supplier reports the incident immediately. Guests who ask to access or correct their information will need the supplier’s co-operation too. Once the service ends, information should be returned or securely deleted, subject to lawful retention requirements.

After signature, ask for evidence that the agreed controls are working.

Confirm the Legal Basis for Overseas Transfers

Using an international booking or cloud service may involve transferring guest information to a third party outside of South Africa. Section 72 allows these transfers only where an applicable legal condition is met.

For ongoing arrangements, the starting point is usually protection at the destination. A transfer is permitted where the recipient is bound by a law, binding corporate rules or a binding agreement that provides protection substantially similar to POPIA and carries safeguards for onward transfers. In practice, this will typically be a properly drafted agreement with the provider.

The remaining grounds are linked to the guest. Informed consent is one. Many routine transfers rest on necessity, because the information has to travel for the business to perform the guest’s contract or act on a request made before booking. The same applies to a contract with a third party concluded in the guest’s interest. A narrow exception covers transfers that benefit the guest where consent cannot reasonably be obtained and the guest would likely have given it.

Choosing the right ground depends on knowing where the information actually goes. Before using a service, ask the provider where guest information and its backups are held and who can access them. Confirm whether further suppliers receive the information as well, since Section 72 expects safeguards to follow any onward transfer.

Record the ground relied on, together with the evidence supporting it, so that the decision can be explained if a guest or the Information Regulator asks. Where that ground is a binding agreement, read it for substance. A vague promise to keep information confidential will not provide the protection required.

For example, sending booking details to an overseas lodge to arrange a guest’s requested stay may be necessary for the booking. Uploading a guest contact list to an overseas advertising platform to target promotions serves a different purpose and requires its own assessment. Special personal information, such as health details, and children’s information need additional care. Section 57(1)(d) requires prior authorisation from the Information Regulator before either is transferred to a third party in a foreign country without adequate protection as contemplated in Section 72.

Make Privacy Part of Everyday Service

Guests are more comfortable with sharing information when they understand why it is being requested. At the point of collection, explain what is required and how it will be used, along with who will receive it. Where information will travel overseas, say so and describe the protection in place.

Behind the scenes, the guiding principle is restraint. Collect only what the booking or stay calls for, and limit access to staff who need it for their role. Retention periods should reflect the purpose that the information was collected for and any legal requirement to keep records. Guests who want to see or correct their information should find the process straightforward.

Booking communications and promotional messages need to be treated separately, because a previous stay does not automatically permit electronic marketing. Section 69 generally requires consent. An exception exists for existing customers, and it is limited to marketing the business’s own similar services. It also depends on the guest being able to opt out, freely and simply, both when their contact details are first collected and in each marketing message sent afterwards.

Staff also need to know what to do when something goes wrong. An operator must alert the responsible party immediately when there are reasonable grounds to believe that information has been accessed or acquired without authorisation. The responsible party must then notify the Information Regulator and identifiable affected guests as soon as reasonably possible, subject to POPIA’s qualifications. Because this duty arises on discovery, notification should be assessed while the investigation is still under way.

Trust is Earned in Practice

Guest trust depends on how these arrangements work in practice. Supplier controls and overseas transfers should be reviewed regularly, along with staff access, because systems and suppliers change over time. When guests are told plainly how their information is handled and see it protected consistently, responsible data handling becomes part of the service promise.