POPIA · Section 18 · 2026
POPIA-Safe Pool Quote Checklist for SA Homeowners
Submitting a pool quote request looks harmless — your name, email, suburb and a project description. In practice, that form is a regulated data-processing event under the Protection of Personal Information Act, and the operator has specific obligations the moment you click submit. This checklist shows the six lawful collection patterns (green flags) and the six unlawful or high-risk ones (red flags) that should prompt you to walk away.
Green flags — lawful
- Name and contact details
Full name, email and phone number for direct communication about your quote — the minimum lawful basis.
- Property suburb (not full address)
Suburb is enough to scope a quote. Full street address should only be requested when you confirm a site visit.
- Pool size and type preferences
Material, dimensions and style help generate a meaningful estimate. This is purpose-limited data collection — the POPIA standard.
- Budget range
An indicative range is reasonable and helps the builder filter scope. Hard requirement for an exact figure is not.
- Builder identifies their Information Officer
POPIA Section 56 requires every responsible party to designate an Information Officer. Their name and contact must be discoverable before you submit data.
- Clear opt-in consent, not pre-ticked
Active opt-in for marketing or data sharing is a POPIA requirement. Pre-ticked boxes are non-compliant under regulator guidance.
Red flags — walk away
- ID copy demanded before contract
South African ID is not required to issue a quote. Requesting it pre-contract is a serious POPIA red flag and creates identity-theft exposure.
- Banking details before site visit
No legitimate quote process requires your bank account number. This is a fraud risk indicator — walk away.
- Pre-ticked direct-marketing consent
Consent must be active. A pre-ticked subscription to newsletters or partner offers is non-compliant and the regulator has issued enforcement notices for it.
- No POPIA notice on the quote form
Section 18 requires a clear privacy notice at the point of collection — purpose of processing, who has access, retention period, your rights. Its absence is non-compliance.
- Data sold to multiple builders without disclosure
Lead-aggregator sites that share your details with several builders must disclose this and obtain explicit consent. Silent onward transfer is unlawful.
- No Information Officer named anywhere
If the website has no privacy policy, no registered Information Officer and no contact for data subject requests, it cannot lawfully process your information.
Frequently Asked Questions
This guide is independent editorial content and does not constitute legal advice. Refer to the Information Regulator (SA) and the POPI Act for binding requirements. See our editorial standards.