Is your business POPIA compliant?

POPIA (the Protection of Personal Information Act 4 of 2013) is South Africa's data protection law. It applies to virtually any business that processes personal information in South Africa, whether or not you're online-only - staff records, a customer database, or even a paper filing system all count.

Accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. Our questionnaire scores your business against each one individually so you can see exactly where the gaps are.

Yes - POPIA requires most organisations that process personal information to register an Information Officer with the Information Regulator (by default this is the CEO/head of the organisation, unless someone else is formally appointed). We generate the registration pack from your questionnaire answers.

Section 22 of POPIA requires notifying the Information Regulator, and in most cases the affected individuals, "as soon as reasonably possible" after you become aware of a breach. Our breach-response tool assesses whether your incident triggers that duty and drafts the notifications for you to review.

The questionnaire itself takes most businesses 15-30 minutes. You get your scored report immediately; the generated PAIA manual, privacy policy, and Information Officer pack are then reviewed by our team before you rely on them.

POPIA's definition is broad - basically anything that identifies or relates to a living person (and in some cases a deceased or juristic person): names, ID numbers, contact details, financial information, even an IP address in some contexts. Flag anything you're unsure about during the questionnaire and our team will help you classify it.

Special personal information (POPIA s26-33) covers particularly sensitive categories - religious/philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric data, and criminal behaviour. It generally can't be processed unless a specific exception applies, and our questionnaire includes a dedicated gate for it.

It's not a black box - every question maps to one of POPIA's 8 conditions, and any gap is ranked by severity (critical, high, or medium) so you can see and contest each finding individually, rather than trusting an opaque overall score.

Usually both - a PAIA (Promotion of Access to Information Act) manual explains how someone can request records from you, while your privacy policy explains what you collect and why. We generate both from the same questionnaire answers.

POPIA compliance isn't a once-off certificate - it needs ongoing attention as your business, systems, and data practices change. We'd recommend re-running the questionnaire whenever something material changes (a new system, a new type of data collected, a new third party you share data with).

It's built for any size - POPIA doesn't exempt small businesses from compliance, though what 'proportionate' security safeguards and documentation look like does scale with your size and risk. The questionnaire adapts based on your answers rather than assuming a large-company structure.