23 audit-ready steps, organised around the eight conditions for lawful processing defined by South Africa's Protection of Personal Information Act. Built for SMEs who need a defensible position — not a legal essay.
Free · No signup · Updated for the latest Regulator guidance
Appoint, register and resource an Information Officer who owns POPIA compliance end-to-end.
Submit the IO registration to the Information Regulator and keep proof on file.
Written policies covering processing, retention, security, and breach response.
Required for groups, franchises, or branches operating semi-independently.
Collect the minimum personal information needed, lawfully and directly from the data subject where possible.
Web forms, CRMs, payroll, CCTV, support tickets — list source, purpose and storage.
Consent, contract, legal obligation, legitimate interest, or public interest.
Remove form fields you don't strictly need. 'Nice to have' is not a lawful basis.
Be explicit about why you hold information and delete it when the purpose is fulfilled.
Customers, employees, suppliers, marketing leads — each gets a defined purpose.
Anchor every dataset to a statutory or operational retention rule, then automate deletion.
Document what was deleted, when, and by whom — auditors will ask.
Don't repurpose data for unrelated activities without a fresh lawful basis.
Marketing cannot reuse a support dataset without consent or a compatibility test.
Document why a new use aligns with the original purpose before approving it.
Keep personal information accurate, complete and up to date.
Customers and employees must be able to fix their own records.
Stale CRM, HR and supplier records are a POPIA risk and a business one.
Tell people what you do with their information and publish a PAIA manual.
Plain language, covers all 8 conditions, linked from every form.
Hosted on your site; updated when systems, products, or processors change.
Specific categories of data (children, special information) trigger prior authorisation.
Protect personal information with appropriate technical and organisational measures.
Identify reasonably foreseeable internal and external risks per system.
Baseline controls expected by the Regulator and most enterprise procurement teams.
Cloud providers, payroll bureaus, marketing tools — all need a Section 21 contract.
Includes the 'as soon as reasonably possible' notification path to the Regulator and data subjects.
Let people see, correct and delete their information on request.
Email alias at minimum; a tracked workflow is better.
Respond within 30 days; document extensions in writing.
Avoid handing personal information to the wrong person — that itself is a breach.
Privara turns each of these 23 steps into a tracked workflow with generated evidence, owner assignments, and audit trails. Free for 14 days.
Start free trial