POPIA compliance consulting for personal information handled lawfully in South Africa.

What it is

What is POPIA and what is it used for?

POPIA is South Africa's data protection statute: the Protection of Personal Information Act 4 of 2013. It governs how public and private bodies collect, use, store, share and dispose of personal information, and it gives the people that information relates to, called data subjects, rights they can enforce. The body that decides why and how information is processed is the responsible party; an operator processes on its behalf under contract.

The Act is enforced by the Information Regulator, an independent body set up under section 39 with a dual mandate covering POPIA and the Promotion of Access to Information Act (PAIA). In practice, organisations use POPIA as the baseline for customer trust, for supplier due diligence from South African clients and for answering the Regulator if a complaint or a security compromise arises.

Current position. The Act was assented to on 19 November 2013. Most of its provisions, including the conditions for lawful processing, commenced on 1 July 2020, and processing then had to be brought into line within one year. The Regulations under the Act were published on 14 December 2018. There is no POPIA certificate: compliance is something you demonstrate, not something a body awards.

Who it is for

Who needs POPIA compliance?

Almost every organisation active in South Africa handles personal information about staff, customers or suppliers, so the question is rarely whether POPIA applies, but how well you can show it is met. Organisations come to Sterling from four starting points:

• A customer's due diligence asks about POPIA. Banks, insurers, retailers and public bodies send questionnaires to suppliers and operators. You need answers backed by documents and records, not a promise.
• A tender requires evidence of data protection. Bid teams are asked for the information officer's registration, a privacy notice, security measures and operator agreements, often within days.
• The Regulator, a complaint or an incident has focused attention. A data subject's complaint or a security compromise tests whether notification, access and correction procedures actually work.
• A group company operates in South Africa. Multinationals with a local subsidiary, or a South African business serving other markets, need POPIA aligned with the GDPR and other privacy laws in one programme.

Compliance is continuous: new systems, new suppliers and new uses of data each need to meet the conditions, so ownership inside the business matters more than any single project.

Requirements

What are the main POPIA requirements?

The heart of the Act is Chapter 3, which sets eight conditions for lawful processing. Around them sit duties on information officers, rules for special personal information, direct marketing, cross-border transfers and the Regulator's enforcement powers. The list below summarises them at title level; it is not legal advice, and interpretation for your organisation is confirmed with your legal advisers.

• Accountability: the responsible party ensures that every condition is met, from the moment the purpose is set to the processing itself.
• Processing limitation: process lawfully, minimally and on a justified ground.
• Purpose specification: collect for a specific, defined purpose and keep records no longer than that purpose requires.
• Further processing limitation: any later use must be compatible with the original purpose.
• Information quality: take reasonable steps to keep information complete, accurate and up to date.
• Openness: maintain documentation of processing and tell data subjects what is collected and why when you collect it.
• Security safeguards: protect integrity and confidentiality, control operators by contract and notify the Regulator and data subjects of security compromises.
• Data subject participation: let people access and correct the information held about them.
• Special personal information: a general prohibition with defined authorisations for the categories the Act protects most closely.
• Information officer, prior authorisation and codes of conduct: the registered officer's duties, processing that needs the Regulator's authorisation first, and sector codes.
• Direct marketing, directories and automated decisions: limits on unsolicited electronic marketing and on decisions made solely by automated means.
• Transborder information flows: conditions for transferring personal information outside the Republic.

Compliance route

How do you achieve POPIA compliance?

POPIA compliance is built, then maintained. Nobody issues a pass mark: the Information Regulator can investigate and act, and your customers can ask for evidence at any time. The route below takes an organisation from uncertainty to a programme it can defend.

1. 01
   Map the personal information you process.Identify data subjects, sources, purposes, systems, operators and any transfers outside South Africa.
2. 02
   Gap analysis: assess practice against the eight conditions.Compare what happens today with the Act and its Regulations, rank the gaps by risk and agree owners and dates.
3. 03
   Put the programme in place.Register the information officer, designate deputies, issue notices, update contracts, apply security measures and train staff.
4. 04
   Test it through internal audit and review.Audit the programme, rehearse a security compromise and an access request, and close findings with evidence.
5. 05
   Keep it running.Review new processing, answer data subject requests, report compromises to the Regulator and refresh training as the business changes.

Check the route before you sign. POPIA contains no certification scheme, so treat any offer of a "POPIA certificate" with caution: it cannot show a customer or the Regulator that the conditions are met. Information officers are registered with the Information Regulator through its own eServices portal; confirm registration and current guidance directly on inforegulator.org.za.

Cost

How much does POPIA compliance cost?

The cost of a POPIA programme follows the volume and sensitivity of the information you handle, not your headcount alone. A professional firm holding client records needs a different scope from a retailer running loyalty data and marketing across many channels. Every component is shown in the proposal, and nothing is added later.

Timeline

How long does POPIA compliance take?

Timing depends on how far your records, contracts and controls already go, how quickly decisions are signed off and how much system change is needed. As an estimate, a first compliance programme usually takes three to six months to design, implement and test, after which it runs as part of normal operations.

If a customer or tender date is driving the work, tell us at the outset; we will show what evidence can be ready by then and which items must follow.

Your engagement

What your POPIA engagement includes

Your engagement runs on Sterling OS™. You choose one of two support levels: Design™, where our consultants guide your team as it builds the programme, or Drive™, where we manage the build for you. Once the programme is in place, Sustain™ keeps it current, and Automate™ is Effivity, the platform the programme runs on.

• Processing map and gap analysis

  Every activity against the eight conditions, with a prioritised plan and named owners.

• Policies, notices and operator agreements

  Drafted around your operations for review by your legal advisers.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Information officer support

  Help with registration, deputy designations and a working procedure for requests and security compromises.

• Internal audit and review

  An independent check of the programme, with findings closed before customers or the Regulator ask.

Sterling does not certify, attest or validate POPIA compliance, and does not give legal advice; the Information Regulator monitors and enforces the Act.

Often combined with

Standards organisations pair with POPIA (South Africa)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.