How to Achieve POPIA Compliance in 10 Steps

These are the 10 steps to achieve POPIA compliance

1. Confirm whether POPIA applies and define the scope
2. Build a complete personal information inventory
3. Appoint and resource the Information Officer
4. Establish a lawful basis and purpose for each processing activity
5. Control special personal information and children’s information
6. Provide transparency and enable data subject rights
7. Apply security safeguards and prepare for breaches
8. Manage operators, vendors and cross-border transfers
9. Apply retention, destruction and information quality controls
10. Train staff, monitor compliance and improve continuously

The Protection of Personal Information Act 4 of 2013, known as POPIA, governs how public and private bodies collect, use, store, share and protect personal information in South Africa. Most of its substantive provisions came into force on 1 July 2020, with a 12-month grace period that ended on 30 June 2021. The Act applies to organisations established in South Africa and, in certain circumstances, to organisations located outside the country that process personal information using means located in South Africa.

POPIA compliance is not achieved simply by publishing a privacy policy. Organisations need to understand their information flows, assign responsibilities, document lawful bases, manage vendors, protect personal information and respond effectively when data subjects exercise their rights.

The official text of POPIA should be read alongside the regulations, codes of conduct and guidance issued by the Information Regulator.

10 practical steps to achieve POPIA compliance

1. Confirm whether POPIA applies and define the scope

Identify the responsible party

Determine which organisation decides why and how personal information is processed. Under POPIA, this organisation is usually the responsible party.

In a group structure, different entities may act as responsible parties for different activities. A parent company may decide how employee information is used, while a subsidiary may determine how its customer information is processed for its own services.

The scope should cover employees, candidates, customers, prospects, suppliers, contractors, website visitors and anyone else whose information is processed.

Review territorial connections

POPIA can apply to organisations located outside South Africa when they process personal information using means located in South Africa, in line with the Act’s rules on application.

International organisations should document why POPIA does or does not apply to their South African operations, systems, vendors and customer relationships.

2. Build a complete personal information inventory

Map the information collected

The inventory should identify categories such as:

• Identity data.
• Contact information.
• Account data.
• Employment records.
• Payment information.
• Health information.
• Location data.
• Communications.
• Usage data.
• Biometric information.
• Information relating to children.

It should also record where the information is collected, how it is used, where it is stored, who can access it and when it should be deleted.

For a broader view of how privacy governance, operational workflows and evidence fit together, organisations can consult PrivaLex’s GDPR compliance readiness assessment.

Map systems and vendors

The inventory should link each processing activity to the relevant application, database, cloud service, team and vendor. APIs, marketing platforms, support tools, HR systems and manually maintained files should also be included.

Technology companies should also review SaaS subscriptions and integrations contracted directly by individual departments. PrivaLex’s risk assessment approach for ISO 27001 and NIS2 shows how technical dependencies, privacy risk exposure and evidence requirements can be assessed together.

3. Appoint and resource the Information Officer

Define their responsibilities

The Information Officer may be responsible for:

• Maintaining privacy policies.
• Coordinating data subject requests.
• Acting as liaison with the Information Regulator.
• Handling complaints.
• Supporting impact assessments.
• Coordinating breach response.
• Monitoring compliance.
• Maintaining records and evidence.

By law, the Information Officer is the head of the organisation, who may designate Deputy Information Officers and must register with the Information Regulator. The organisation should define the Information Officer’s authority, resources and reporting line. Naming someone without giving them access to the necessary teams and records does not create effective accountability.

Check the regulator’s requirements

The organisation should confirm its current registration, notification and documentation obligations using the Information Regulator’s official resources.

Responsibilities under POPIA and the Promotion of Access to Information Act may overlap, but their specific requirements should remain visible within the organisation’s governance model.

4. Establish a lawful basis and purpose for each processing activity

Document the legal justification

For each activity, record:

• The purpose of the processing.
• The personal information involved.
• The applicable lawful basis.
• The data subjects affected.
• The retention period.
• The recipients or vendors involved.
• Any cross-border transfer.
• The security safeguards applied.

POPIA does not require consent for every processing activity. Depending on the circumstances, processing may be justified by consent, a contract, a legal obligation, a public law duty or another recognised lawful basis.

Manage consent properly

Where consent is used, it must be voluntary, specific and informed. The organisation must be able to show when it was obtained, what information the person received and how they can withdraw their consent.

Direct marketing also needs careful review. The organisation should distinguish between communications to existing customers, promotional messages, electronic communications and marketing aimed at new prospects. Direct marketing by electronic communication to non-customers requires prior consent; since 2025, the Regulations expressly state that an opt-out mechanism is not valid consent.

5. Control special personal information and children’s information

Identify the higher-risk categories

Special personal information may include data on race, ethnic origin, trade union membership, health, sex life, biometric information, religious or philosophical beliefs, political persuasion and criminal behaviour.

The organisation should identify where this information is processed, why it is needed and which safeguards apply. Access should be limited to the people who genuinely need it for a defined purpose.

Apply enhanced measures for children

Organisations should confirm whether they may process children’s information, whether the consent of a competent person is required and how age-related risks are managed.

Products aimed at children, education providers, healthcare services and family platforms should review privacy policies, consent flows, product design and retention settings together.

6. Provide transparency and enable data subject rights

Publish accurate privacy information

Privacy policies should explain:

• Who processes the information.
• What information is collected.
• Why it is used.
• Which lawful basis applies.
• Who receives the information.
• Whether it is transferred outside South Africa.
• How long it is kept.
• How rights can be exercised.
• How complaints can be lodged.

The policy must reflect actual processing. A generic template becomes a weakness if it does not match the organisation’s systems, vendors or business model.

Build a workflow for rights requests

The organisation should define how requests are received, how identity is verified, which teams search for the information, who assesses limitations and how responses are approved.

The process should cover production systems, archives, backups, email accounts, collaboration tools and vendor platforms.

7. Apply security safeguards and prepare for breaches

Use a risk-based security model

POPIA requires responsible parties to protect personal information against loss, damage, unauthorised access, interference, modification, destruction and disclosure.

Safeguards may include:

• Least-privilege access.
• Multi-factor authentication.
• Encryption.
• Secure configuration.
• Vulnerability management.
• Logging and monitoring.
• Backup and recovery.
• Secure development.
• Endpoint protection.
• Data loss prevention.
• Staff training.
• Vendor security reviews.

These safeguards should be linked to a risk register and a treatment process. A structured risk management framework can help connect privacy risks to owners, actions and evidence.

Establish a breach response process

The response process should define how incidents are detected, who leads the investigation, how evidence is preserved, when vendors are involved and when notifications must be made.

Organisations should also test the process through tabletop exercises or simulations. A written incident policy is not enough if teams do not know who makes decisions under pressure. Since April 2025, security compromise notifications to the Information Regulator must be submitted through its mandatory e-portal (eServices).

8. Manage operators, vendors and cross-border transfers

Define operator responsibilities

Operators may include cloud providers, payroll services, customer service platforms, payment processors, marketing tools and managed security providers.

The responsible party must know which operators process personal information, what they do with it and where it is stored. Contracts should address confidentiality, security safeguards, incident notification, support with data subject requests, deletion or return of information and cooperation with audits.

Assess cross-border transfers

Cross-border transfers must be assessed against POPIA’s requirements. The organisation should consider the recipient’s legal protections, contractual safeguards, consent, the relationship between the parties and the purpose of the transfer.

The analysis should cover cloud hosting, remote support, administration, analytics, customer service tools and processing carried out by companies within the same group.

9. Apply retention, destruction and information quality controls

Set retention rules

Personal information should not be kept for longer than necessary for the purpose for which it was collected, unless another legal or operational requirement justifies keeping it.

Retention schedules should distinguish between:

• Active records.
• Inactive records.
• Legal holds.
• Backups.
• Audit logs.
• Security logs.
• Employee records.
• Customer records.
• Support data.

Keep information accurate and complete

The organisation should provide practical ways to correct inaccurate information and to reconcile important records across different systems.

The link between risk decisions, retention controls and evidence can be structured through an ISO 27001 risk treatment plan, even when ISO 27001 certification is not part of the immediate scope.

10. Train staff, monitor compliance and improve continuously

Train teams according to their roles

Marketing teams may need training on direct marketing and consent. Engineers may need guidance on access, logging and data minimisation. Customer service staff should be able to recognise rights requests, while procurement teams should understand operator due diligence.

Review the programme regularly

POPIA compliance should be reviewed when:

• New products or services are launched.
• New vendors are onboarded.
• Processing purposes change.
• A security incident occurs.
• The regulator publishes new guidance.
• The organisation expands into another country.
• A data subject complaint reveals a weakness.

Organisations that need additional governance capacity can also consider external DPO support for ongoing privacy oversight, advice and coordination.

Making POPIA compliance operational with PrivaLex

At PrivaLex we help technology companies, digital platforms and other data-driven organisations turn POPIA requirements into a practical privacy and security operating model.

The work starts with a scoping and gap assessment. We identify processing activities, categories of personal information, responsible parties, operators, systems, internal owners and existing safeguards. This provides a clear basis for prioritising work instead of relying on generic privacy templates.

We then help structure the programme around POPIA’s eight conditions. This can include processing inventories, lawful basis analysis, privacy policies, data subject rights workflows, retention rules, operator reviews, cross-border transfer assessments, security safeguards and breach response procedures.

When the organisation also needs to address the GDPR, ISO 27001, NIS2, DORA or other sector requirements, we map common controls into a coordinated programme. This avoids repeating the same vendor assessment, risk review or evidence collection for each framework, while keeping POPIA-specific obligations visible.

Our support can also include assistance to the Information Officer, policy implementation, staff training, privacy impact assessments, incident simulations, internal audit preparation, management reporting and follow-up of corrective actions. The goal is to help the organisation run its privacy programme day to day and show how decisions are made.

For organisations already using a GRC or compliance platform, we help configure it around the real processing environment. This includes assigning owners, structuring evidence, defining review cycles and connecting privacy records with security and vendor management processes.

The 8 conditions for lawful processing

POPIA sets out eight conditions that organisations must address when processing personal information.

POPIA condition	What it requires	Evidence examples
Accountability	The responsible party must take responsibility for compliance.	Governance records, assigned owners and policies
Processing limitation	Personal information must be processed lawfully, reasonably and transparently.	Lawful basis analysis, consent records and collection notices
Purpose specification	Information must be collected for a specific, explicitly defined and lawful purpose.	Processing inventory and purpose statements
Further processing limitation	Further use must be compatible with the original purpose.	Use case reviews and change assessments
Information quality	Personal information must be accurate, complete and kept up to date where necessary.	Quality procedures and correction records
Openness	Data subjects must understand how their information is processed.	Privacy policies and Information Officer details
Security safeguards	Appropriate technical and organisational measures must be applied.	Risk assessments, access reviews and incident logs
Data subject participation	Individuals must be able to exercise their rights.	Request procedures, response logs and identity checks

A compliance programme should connect these conditions to the organisation’s real systems, processes, vendors and people. The organisation should be able to show not only that a policy exists, but also how it works in practice.

Conclusion

Achieving POPIA compliance takes much more than a privacy policy or a signed consent form. Organisations need a connected programme that covers:

• Scope and accountability.
• Personal information inventories.
• Lawful processing and purpose limitation.
• Information Officer responsibilities.
• Data subject rights.
• Security safeguards and breach response.
• Operators and cross-border transfers.
• Retention and information quality.
• Training, monitoring and continuous improvement.

The most effective approach is to start with the organisation’s real processing activities and risks, and then build the policies, controls and evidence needed.

Book a strategy session with PrivaLex to review your POPIA requirements and prioritise your next actions. You can also request a risk assessment if you need a first view of your privacy and security exposure.

Frequently Asked Questions (FAQs)