Know What POPIA Demands
- ▸Process personal information lawfully, fairly and transparently.
- ▸Collect only what is adequate, relevant and necessary for a defined purpose.
- ▸Stop retaining records once the purpose is fulfilled or law requires deletion.
- ▸Honour data subject rights: access, correction, objection and deletion.
- ▸Register your Information Officer with the Regulator and publish PAIA manuals.
Map and Audit Your Data
- ▸Build an inventory of every system holding personal information.
- ▸Diagram how data flows between departments, vendors and borders.
- ▸Define retention periods per record type and automate enforcement.
- ▸Store proof of consent alongside the records it covers.
- ▸Review contracts with operators processing data on your behalf, as section 21 requires.
Put Security Safeguards in Place
- ▸Encrypt personal information at rest and in transit.
- ▸Control access by role, enforce MFA and review permissions quarterly.
- ▸Follow secure development practices for anything handling customer data.
- ▸Secure physical spaces: server rooms, filing cabinets and reception areas.
Stay Compliant Over Time
- ▸Run annual compliance audits and track findings to closure.
- ▸Train every employee annually; compliance is a habit, not a document.
- ▸Maintain a rehearsed breach response plan with clear escalation steps.
- ▸Log and answer subject-access requests within the legislated timeframes.
Download the POPIA Compliance Checklist
Enter your details and we'll email you the full checklist PDF — free, no strings attached.