POPIA Compliance

Practical compliance with the Protection of Personal Information Act, and what to do after a data breach.

The Protection of Personal Information Act (POPIA) applies to almost every business that collects or uses personal information about customers, employees or suppliers. Non-compliance can lead to fines, reputational harm and civil claims.

Core compliance steps

  • Register your Information Officer with the Information Regulator.
  • Map your personal information: what you collect, why, where it is stored and who it is shared with.
  • Update notices and policies: privacy notices, a PAIA manual and internal policies.
  • Secure your data with appropriate technical and organisational measures.
  • Manage operators: written agreements with service providers that process data for you.

Data breaches

If personal information is accessed or acquired by an unauthorised person, the business must notify the Information Regulator and affected data subjects as soon as reasonably possible.

Direct marketing

Electronic direct marketing generally requires prior consent, unless the person is an existing customer who was given the opportunity to opt out.

Who we help

We assist:

  • SMEs building a POPIA compliance programme.
  • Businesses that have suffered a data breach.
  • Companies sending personal information across borders.
  • Technology and e-commerce businesses.
  • Employers handling employee information.
  • Businesses responding to an Information Regulator inquiry.

Our compliance process

Five steps to practical compliance.

  1. Assessment
    We assess how your business collects, uses and shares personal information.
  2. Gap analysis
    We identify gaps against POPIA’s conditions for lawful processing.
  3. Documents
    We prepare privacy notices, a PAIA manual, policies and operator agreements.
  4. Implementation
    We help you implement training, consent processes and breach response procedures.
  5. Ongoing support
    We advise on new processing activities, breaches and Regulator queries.

We also advise businesses operating internationally on how POPIA interacts with the EU’s GDPR.

GET IN TOUCH

What to prepare

Information that helps us assess compliance.

  • A description of your business and the personal information you collect.
  • Your current privacy policy and website terms.
  • A list of IT and service providers that process data.
  • Any existing PAIA manual.
  • Details of any data incidents.

Common Questions

Yes. POPIA applies to any business that processes personal information, regardless of size.
The Information Regulator can issue enforcement notices and administrative fines of up to R10 million. Some offences carry fines or imprisonment, and data subjects can claim damages.
By default, it is the head of the business, such as the CEO or managing director. They may delegate duties to deputy information officers, but remain accountable.
No. Consent is one of several lawful grounds. Processing may also be justified where it is necessary for a contract, a legal obligation or a legitimate interest.
Contain the breach, assess what information was affected, and notify the Information Regulator and affected individuals as soon as reasonably possible. Get legal advice early.

NEED HELP WITH POPIA?

We help businesses put practical, proportionate POPIA compliance in place and respond quickly when a breach occurs.

Read more: Data breaches under POPIA · Direct marketing and data protection

REQUEST A CALL BACK
Facebook Instagram X-twitter Linkedin Tiktok Youtube

This page is general information and not legal advice.

Get in touch

Please complete the following form to get in touch with us.

"*" indicates required fields

This field is for validation purposes and should be left unchanged.