South Africa · Compliance
Protection of Personal Information Act (POPIA) compliance in South Africa
Achieve Protection of Personal Information Act (POPIA) compliance in South Africa with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Johannesburg office team
- Effivity software included
- Academy training included
Who asks for Protection of Personal Information Act (POPIA) in South Africa
Clients include
Protection of Personal Information Act (POPIA) compliance in South Africa at a glance
Protection of Personal Information Act, 2013 (Act No. 4 of 2013) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in South Africa ask for evidence that you meet it.
Registration with the Information Regulator is where many POPIA programmes begin, because the Regulator states that Information Officers take up their duties only after the responsible party has registered them on its portal. The Protection of Personal Information Act 4 of 2013 then sets the conditions for lawful processing, requires appropriate, reasonable technical and organisational security measures, restricts decisions based solely on automated profiling and governs transfers outside the Republic. The same Regulator, established under section 39 of the Act, also oversees the Promotion of Access to Information Act. There is no POPIA certificate. Compliance is shown through records of processing, privacy notices, operator agreements, security safeguards and a working process for complaints and security compromises; ISO/IEC 27701 certification by an accredited body is an optional way to evidence the privacy management system behind them. Sterling's Johannesburg office runs the work with clear owners for each condition, using Effivity to keep the evidence current. The obligations, the evidence and the questions organisations ask follow.
Who needs Protection of Personal Information Act (POPIA) in South Africa, and what happens without it
These are the organisations in South Africa that most often need to show Protection of Personal Information Act (POPIA).
- Every public and private body processing personal informationPOPIA sets conditions for lawful processing and security safeguards.
- Organisations appointing and registering Information OfficersThe Regulator states Information Officers take up duties only after registration.
- Financial institutions and their service providersPOPIA obligations sit alongside the Joint Standards' cyber and IT requirements.
- Organisations using automated decision making or transferring data abroadPOPIA restricts decisions based solely on automated profiling and governs transfers outside the Republic.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkProtection of Personal Information Act (POPIA) requirements in South Africa
Strip away the vocabulary and POPIA asks a responsible party to comply in six areas drawn from its conditions for lawful processing.
In South Africa these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Protection of Personal Information Act (POPIA) explained →
How to achieve Protection of Personal Information Act (POPIA) compliance in South Africa
One team from the Johannesburg office carries the work from scoping to sign-off. On-site from the Johannesburg (Sandown) office across Gauteng and, by arrangement, other provinces; remote delivery for distributed teams.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Protection of Personal Information Act (POPIA) and the South African requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Protection of Personal Information Act (POPIA) compliance take in South Africa?
There is no standard duration: it depends on your scope and on how much of the system already runs. In South Africa these are the factors that set the timeline.
- Number of processing activities and systems to map
- Number of operators and cross-border transfers to review
- Information Officer and deputy designation and registration
- Security safeguard remediation needed
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Protection of Personal Information Act (POPIA) compliance cost in South Africa?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In South Africa these factors move both.
- Number of legal entities and business units in scope
- Volume and sensitivity of personal information, including special personal information
- Operator agreement review
- Security control remediation
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Protection of Personal Information Act (POPIA) consultants and assessors in South Africa
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Protection of Personal Information Act (POPIA) and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in South Africa are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Protection of Personal Information Act (POPIA) in South Africa (3)
| Instrument | How it treats the standard |
|---|---|
| Protection of Personal Information Act, 2013 (Act No. 4 of 2013) | The instrument itself Conditions for lawful processing, security safeguards, notification of security compromises, automated decision making and transborder flows. |
| Information Regulator — Information Officer registration | Regulator requirement Information Officers take up their duties only after being registered on the Regulator's portal (section 55(2)). |
| Promotion of Access to Information Act 2 of 2000 | Related Overseen by the same Regulator under its dual mandate. |
Accreditation, audit language and remote audits in South Africa
Compliance, not certification: POPIA has no certificate. Evidence is the responsible party's records, notices, operator agreements, security safeguards and Information Officer registration. ISO/IEC 27701 certification by an accredited body is an optional way to evidence the privacy management system. Edition and transition details: Protection of Personal Information Act (POPIA) hub →
Audit language
Privacy notices should be in a language the audience understands; internal records are commonly kept in English.
Remote and on-site
Data mapping workshops can be on-site or remote; the Act prescribes no external assessment.
Protection of Personal Information Act (POPIA) in South Africa: questions clients ask
Is there a POPIA certificate?
No. POPIA has no certificate. You show compliance through your own evidence: records, privacy notices, operator agreements, security safeguards and the registration of your Information Officer. ISO/IEC 27701 certification by an accredited body is an optional way to evidence a privacy management system. Confirm your position with your counsel or the Information Regulator.
Who must register an Information Officer with the Information Regulator?
Both public and private bodies, according to the Information Regulator. Information Officers take up their duties only once registered on the Regulator's portal, as section 55(2) provides. Designate your Information Officer and any deputies first, then register them. Confirm the current procedure with the Information Regulator before you act.
Does POPIA require ISO 27001?
No. POPIA section 19 requires appropriate, reasonable technical and organisational measures, having due regard to generally accepted information security practices and procedures. It cites no standard, so ISO 27001 is one route you may choose, not a requirement. For your own safeguards, ask your counsel whether they meet the Act.
Does POPIA restrict automated decision making?
Yes, with exceptions. POPIA restricts decisions that rest solely on automated processing intended to profile a person, where those decisions have legal or substantial effect. The Act also governs transfers of personal information outside the Republic. Whether an exception covers your use is a legal question, so take advice from your counsel or the Information Regulator.
More on Protection of Personal Information Act (POPIA) for South African organisations
Other standards South African businesses ask Sterling for
Organisations in South Africa often combine Protection of Personal Information Act (POPIA) with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Johannesburg office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Protection of Personal Information Act, 2013 (Act No. 4 of 2013) — gov.za (accessed 5 Oct 2026)
- Information Regulator — Information Officer registration — inforegulator.org.za (accessed 5 Oct 2026)
- Promotion of Access to Information Act 2 of 2000 — gov.za; inforegulator.org.za (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice