3 September 2026LANTEK Computers
When businesses map what personal information they hold, they list the systems. Almost nobody lists the front door, and the front door is collecting more than most of the systems are.
None of this is legal advice, and the biometric point in particular is worth taking to your attorney.
Why all three are in scope
POPIA covers personal information about an identifiable living person. It does not require the information to be in a database.
CCTV footage is an image of an identifiable person, along with the time and place they were there. That is personal information.
Access control records show who entered, when and where. Personal information, and where it is biometric it is more sensitive than that.
A visitor book is a paper record of names, companies, vehicle registrations, times and often telephone numbers. Paper does not exempt it, and a book left open on a counter is arguably worse than a database, because every visitor can read every previous entry.
So each needs the same four things any other processing needs: a purpose, a lawful basis, security, and a decision about how long you keep it.
Biometrics deserve separate thought
Fingerprint and facial readers have become the default on South African sites, and they are treated more strictly than a card or a code.
Two reasons this matters practically. A fingerprint cannot be reissued: if a card is compromised you print a new one, and if biometric data is compromised the person has that biometric for life. And POPIA gives certain categories of information additional protection, with biometric information among the categories generally treated as requiring more care than ordinary personal information.
Whether your specific use is lawful, and on what basis, is a question for your attorney rather than your IT provider. What we would say from a security perspective is that the questions to ask your supplier are: is the biometric stored as a template rather than an image, where does it live, is it encrypted, and who can extract it. If your access control supplier cannot answer those, that is itself the finding.
Also worth asking whether a non-biometric alternative is offered for anybody who objects, because the answer shapes how defensible the arrangement is.
What to actually do about each
CCTV
Have a stated purpose. Security of the premises is a normal and reasonable one. Monitoring how long staff spend away from their desks is a different purpose and needs to be dealt with separately, honestly, and probably with your employment adviser.
Put up signage. Visible, at the entrances, before somebody is recorded, saying that recording is taking place, who is doing it and how to contact them. This is the single most visible indicator of whether a business has thought about this at all.
Point the cameras at what you are protecting. A camera covering the neighbour’s property or the pavement is collecting information about people who are not your concern. Adjust the angle or mask the area.
Secure the recorder. This is where we find the most problems. Recorders are frequently on the network with default credentials and, worse, reachable from the internet so somebody can view the cameras from a phone. A recorder exposed with a default password is a live feed of your premises available to anybody who scans for it. Change the credentials, keep the firmware current, and if remote viewing is needed, do it properly rather than by opening a port.
Decide a retention period. POPIA does not prescribe one. Work from purpose: how long would it take to realise something had happened and ask for the footage? For most businesses that is a small number of weeks, not months, and certainly not forever because the disk is large.
Control who can view it. A named few, with a record of when footage is exported and why.
Access control
Same purpose and retention thinking. Plus: remove leavers from the system on the day they leave, which is the same discipline as closing their accounts and is missed about as often. And ask what the supplier can see, because a maintained system frequently means a third party with remote access to your building’s entry records.
The visitor book
The easiest fix on this page. A book where each visitor can read every previous entry is disclosing your visitors’ details to your other visitors, including which of your competitors called last week.
Replace it with single sheets, a covered sheet, or an electronic sign-in. Then decide how long the records are kept and where the old ones go, because a box of visitor books in a storeroom is a records problem nobody has ever reviewed.
The requests you should expect
People have the right to ask what you hold about them, and that includes footage.
Two practical complications worth knowing before the first request arrives. Footage of one person usually contains other people, and providing it unedited discloses their information; this is a real and awkward problem and it is why redaction exists. And a request for footage from four months ago cannot be met if your retention is four weeks, which is a legitimate answer provided the retention decision was made deliberately and can be shown.
Decide now who handles such a request. Per the Information Officer role, it lands with them.
The short version
Signage up. Purpose written down. Retention decided rather than defaulted. Recorder credentials changed and not exposed to the internet. Leavers removed. Visitor book replaced with something that does not show every entry to every visitor. Access to footage limited to named people.
That list is an afternoon and it covers most of what an assessment would look for. It also belongs on the readiness checklist, where it is item eleven.
How the security side of this fits together is on Compliant by design and IT Infrastructure. If you have a recorder on your network and nobody knows whether it is reachable from outside, that is worth checking.