PAIA and POPIA Manual

Manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 4 of 2013 (POPIA) – Camera, Licence-Plate Recognition and Access-Control Systems

1. Introduction, purpose and scope

1.1 Security first, visitor management second. The Reserve's camera systems exist first to keep people, wildlife and property in the Dinokeng Game Reserve safe, and to prevent and investigate crime, including poaching. Managing access and visitors is their second purpose. No camera record is collected, used or kept for any other purpose.

1.2 What this manual does. It explains, as PAIA section 51 and POPIA require:

• which camera and access-control systems the Reserve operates, and why;
• what personal information they capture, and what they do not;
• how long each kind of record is kept;
• who may see or receive it, and how it is protected;
• how a person may ask for a record, ask for a correction, object, or complain.

1.3 Scope. The manual covers all camera data of the Reserve as a whole, whichever system captures or stores it: licence-plate recognition (ANPR) cameras at the gates and on the roads, the video management system (DSS Pro), overview, perimeter and thermal cameras, recorders, the Dinokeng ANPR program and its phone app, and the alerts it sends. It is not limited to one system or supplier, and it applies to any camera system added later.

1.4 Relationship to other documents. This manual is read with the Reserve's Protection of Personal Information Policy (2019), the DGRMA Constitution, the House Rules and the Dinokeng Group Governance Framework. Where this manual is more specific about camera data, it applies.

1.5 Definitions. Words defined in POPIA and PAIA have the same meaning here. Camera data means any image, video, licence-plate read, time, place and direction of travel, and any record derived from them. The Reserve, we or us means the Dinokeng Game Reserve Management Association NPC as the responsible party.

2. The Reserve and its Information Officer

2.1 The responsible party for all camera data is the Dinokeng Game Reserve Management Association NPC (DGRMA), a private body under PAIA. It manages the Dinokeng Game Reserve on behalf of its landowners.

2.2 Contact details

2.3 The Information Officer is responsible for this manual, for answering requests and complaints about camera data, and for making sure the systems are used only as this manual allows. The Information Officer and any Deputy must be registered with the Information Regulator.

3. The camera systems and why they exist

3.1 Purposes, in order of priority

1. Security (primary purpose): to protect the people, wildlife and property in the Reserve; to prevent, detect and investigate crime, including poaching, theft, trespass and road offences; to warn the security team about vehicles of concern; and to give evidence to the SAPS and the courts.
2. Visitor and access management (secondary purpose): to control the boom gates for residents and authorised vehicles; to know how many vehicles are inside the Reserve, for safety and for gate closing times; to check that conservation and self-drive fees and concessions apply; and to plan roads, gates and staffing from counts and trends.

The secondary purpose never overrides the first, and no other purpose is allowed (section 4.3).

3.2 Systems covered

3.3 Notice. Signs at every gate and at camera sites tell people that cameras and licence-plate recognition are in use, by whom, for which purpose, and where this manual can be found.

4. Personal information processed

4.1 Whose information, and what

4.2 Flags and alarms. A plate may be flagged because of a security concern (for example a vehicle linked to poaching or theft) or a Management matter (for example an unpaid fine). A flag records a concern about a vehicle and its reason; it is not a criminal record of a person. Where a flag reveals alleged criminal behaviour, it is processed only as POPIA section 33 allows: by the Reserve for its own security, from information obtained lawfully, and shared only with the SAPS or other bodies charged by law.

4.3 What the camera systems do NOT do

• No marketing. Camera data is never used for marketing, advertising, profiling for sales, or any commercial purpose, and is never sold or given to anyone for those purposes.
• No private information of visitors is logged. The camera systems do not record a visitor's name, ID or passport number, address, telephone number, e-mail or payment details. A visitor's vehicle is known only by its plate, its look and where and when it was seen.
• No identification of people from images. No facial recognition is used. Video and pictures are looked at only when a security incident, a complaint or a request requires it.
• No sound is recorded.
• Fee checks are yes or no. When staff or a Voluntary Ranger check a plate, the guest permit system is asked only whether the conservation and self-drive fees are paid; the visitor's booking details stay in the permit system.
• No use outside the purposes in section 3.1, and no automated decision with legal effect on a person: a camera alarm is always checked by a person before anyone acts.

5. How long camera data is kept

Camera data is kept only as long as the security purpose needs it, and never longer than the periods below (POPIA section 14).

5.1 Longer only for a case. A record linked to a reported incident, an investigation, a legal claim, a court case or a request under this manual is kept until that matter is finally closed, then deleted. The Information Officer keeps a list of such records and why they are kept.

5.2 Records that follow a relationship. A vehicle's entry in the residents register, and a user's account, are kept while the vehicle is registered or the user has access, and are deleted or archived when that ends. A signed non-disclosure agreement is kept as a text record for 5 years after the user's access ends.

5.3 Statistics. Counts and trends without any plate or picture (for example vehicles per day per gate) are not personal information and may be kept longer.

5.4 Backups and copies. Backups and exported copies are subject to the same limits: a record past its period is removed from backups when they are next replaced, and copies made for a case are deleted when the case closes. Alert messages in the security chat groups are cleared on the same terms.

5.5 Deletion. Records are deleted so that they cannot be rebuilt, or de-identified. Deletion runs automatically where the system allows it and is checked by the Information Officer at least once a year.

6. Who may see camera data, and how it is protected

6.1 Inside the Reserve, by need. Each user sees only what their role needs. Security staff see reads, pictures and alarms; gate and administration staff see what they need for access and fees; Voluntary Rangers see only whether a plate's fees are paid, whether it holds a self-drive concession, and its time in the park. Video is viewed only by the security team and the Information Officer.

6.2 Outside the Reserve

Camera data is never published, posted on social media or WhatsApp groups, or given to anyone for marketing.

6.3 Transfers outside South Africa. Security alerts are sent to the Security and Management teams through a messaging service (Telegram) whose servers may be outside South Africa. Alerts carry only what the team needs to act: the plate, the place, the time and a picture of the vehicle. Any transfer of personal information outside South Africa, including by hosting or network services, is made only as POPIA section 72 allows.

6.4 Security safeguards (POPIA s19)

• Camera data is stored on the Reserve's own servers on site; plain (unencrypted) access is allowed only from the Reserve's network, and access from outside only over an encrypted (https) connection.
• Every user has a personal login; passwords are stored only in protected (hashed) form; repeated wrong passwords lock the address out.
• Every user signs a non-disclosure agreement before using the systems.
• Rights are set per user and role, and every search, look-up, export and change is recorded in a user log that the Information Officer reviews.
• Voluntary Rangers can look up plates only from inside the Reserve, within daily limits, and their reports need a fresh photo and their location.
• Cameras, recorders and servers are kept in locked places, and their passwords are changed when staff with access leave.

6.5 Security breaches. If camera data is, or may have been, accessed or taken without authority, the Information Officer notifies the Information Regulator and the people affected as soon as reasonably possible (POPIA s22), and records what happened and what was done.

7. Records the Reserve holds (PAIA s51(1)(c) and (d))

7.1 Camera and access-control records

7.2 Other records of the Reserve. Governance records (constitution, minutes, policies), membership and property records, financial and tax records, staff and contractor records, and contracts with service providers. These are held under the Reserve's general record-keeping rules and are available on request under section 8.

7.3 Records available without a request (PAIA s52). This manual; the Reserve's camera and signage notice; the park rules; the POPIA policy. They are available from the Information Officer or on the Reserve's website, free of charge.

7.4 Records kept under other laws (PAIA s51(1)(d)) include the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Occupational Health and Safety Act 85 of 1993, the National Environmental Management: Protected Areas Act 57 of 2003, the Private Security Industry Regulation Act 56 of 2001, and POPIA itself.

8. Asking for records, corrections and complaints

8.1 Your own information (POPIA s23–25). You may ask whether the Reserve holds camera data about you or your vehicle, and for a copy. Write to the Information Officer with proof of identity and, for a vehicle, proof that you own or use it, plus the date, time and place. The Reserve answers within 30 days. Pictures and video are given only with other people and vehicles blurred or removed where needed to protect them. Requests after the retention period may find nothing, because the data has been deleted.

8.2 Other records (PAIA s53). Use PAIA Form 2 (Request for access to a record), available from the Information Officer or the Information Regulator's website. Send it to the Information Officer by e-mail, post or hand. Give enough detail to identify the record, the form of access you want, and, if you act for someone else, your authority.

8.3 Fees (private bodies, Information Regulator schedule 2026)

If the search will take more than 6 hours, a deposit of one third of the access fee is payable first. VAT is added where it applies. Fees may change; the Information Regulator's current schedule applies.

Camera records (footage, pictures and plate reads). Camera records are made available only with a South African Police Service case number, and only with the investigating officer present on site. Searching and preparing camera records costs R500.00 per hour for non-residents of Dinokeng Game Reserve.

8.4 Time to decide. The Information Officer decides within 30 days, and may extend this once by up to 30 days with written reasons (PAIA s56–57).

8.5 Grounds for refusal (PAIA Chapter 4) include: protecting the privacy of other people (s63); commercial or confidential information of third parties (s64–65); safety of people and property (s66); records privileged in legal proceedings (s67); and records whose release could prejudice the prevention or investigation of crime or the security of the Reserve, such as camera positions, alarm settings and flagged-vehicle lists (s66 and s70). Parts that can be separated are still given (s59).

8.6 Correction, deletion and objection. You may ask for incorrect information to be corrected or deleted (POPIA Form 2), and object to processing based on legitimate interests (POPIA Form 1). The Reserve answers within 30 days. Records of a security incident may be kept despite an objection while needed for the case.

8.7 Complaints. First raise the matter with the Information Officer, who answers within 14 business days. If you are not satisfied, you may complain to the Information Regulator (PAIA Form 5; POPIA complaint form) or apply to court within 180 days (PAIA s78).

The Information Regulator's Guide on how to use PAIA is available on its website, in all official languages.

9. Availability and updates of this manual

• This manual is available free of charge from the Information Officer at Plot 11, Rooibank 89JR, Hammanskraal 0400, on the Reserve's website, and on request at the gates. A printed copy costs R2.00 per page.
• The Reserve reviews it every year, and whenever a camera system, a retention period or the Information Officer changes. The version and date are on the first page.
• It is read with the Reserve's POPIA Policy, the park rules and the Voluntary Rangers' rules. Where they differ about camera data, this manual applies.

Annexures (available from the Information Officer)

• A. PAIA Form 2 – Request for access to a record
• B. POPIA Form 1 – Objection to processing
• C. POPIA Form 2 – Request for correction or deletion
• D. Camera notice wording for the gates and signs

Approved by