South Africa
POPIA compliance, made simple
South Africa's Protection of Personal Information Act governs how personal information is collected, processed, and stored by organisations operating in or handling data from South Africa.
ComplianceDesk gives you 22 pre-built POPIA controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving POPIA compliance stops being a spreadsheet exercise.
Every POPIA control, organised for you
The real control library ComplianceDesk seeds the moment you activate POPIA — 22 controls across 9 categories.
Accountability
- POPIA-1.1 Information officer appointed
- POPIA-1.2 Compliance framework documented
Processing Limitation
- POPIA-2.1 Lawful and minimal processing
- POPIA-2.2 Consent or other justification recorded
- POPIA-2.3 Collection directly from data subject
Purpose Specification
- POPIA-3.1 Purpose specified at collection
- POPIA-3.2 Retention and disposal policy
Further Processing Limitation
- POPIA-4.1 Compatibility assessment for new uses
Information Quality
- POPIA-5.1 Data accuracy controls
Openness
- POPIA-6.1 Processing register maintained
- POPIA-6.2 Privacy notice provided to data subjects
Security Safeguards
- POPIA-7.1 Technical and organisational security measures
- POPIA-7.2 Operator agreements in place
- POPIA-7.3 Security compromise notification procedure
Data Subject Participation
- POPIA-8.1 Access request process
- POPIA-8.2 Correction and deletion request process
Special Processing & Cross-Border Transfers
- POPIA-9.1 Special personal information processing restricted
- POPIA-9.2 Children's personal information safeguarded
- POPIA-9.3 Prior authorisation obtained for higher-risk processing
- POPIA-9.4 Direct marketing consent and opt-out honoured
- POPIA-9.5 Cross-border transfer safeguards documented
- POPIA-9.6 Automated decision-making safeguards
Frequently asked questions
How many controls does ComplianceDesk track for POPIA?
22, organised into 9 categories, ready to assign to an owner as soon as you activate the framework.
Can I track POPIA alongside other frameworks?
Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.
How long does it take to set up POPIA in ComplianceDesk?
Activating POPIA instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.
Related guides
- Kenya's Data Protection Act: What Businesses Need to Know →
- Nigeria's NDPA vs South Africa's POPIA: Comparing Africa's Two Major Data Protection Laws →
- GDPR vs POPIA: Key Differences for Businesses Operating Across Africa and Europe →
- POPIA Compliance Checklist: A Practical Guide for South African Businesses →
Other South Africa frameworks
See your full compliance picture
131 frameworks, one system of record.