The Protection of Personal Information Act (POPIA) has been fully in effect since July 2021, and the Information Regulator has become steadily more active since — meaning "we'll get to it eventually" is no longer a safe compliance posture for a business handling South African personal information. This guide walks through what POPIA actually requires in practice, not just what the Act says in theory.
Who does POPIA apply to?
POPIA applies to any "responsible party" — a person or organisation that determines the purpose and means of processing personal information — domiciled in South Africa, or that processes personal information within South Africa's borders, regardless of where the organisation itself is headquartered. If you collect, store, or use identifiable information about South African individuals (customers, employees, job applicants), POPIA almost certainly applies to you.
The eight conditions for lawful processing
POPIA's core is a set of eight conditions every responsible party must satisfy. This is the checklist most audits and self-assessments actually work through:
- Accountability — someone in the organisation is formally responsible for POPIA compliance (see Information Officer, below).
- Processing limitation — you only collect what's adequate, relevant, and not excessive for your stated purpose, and generally need the data subject's consent or another lawful justification.
- Purpose specification — personal information is collected for a specific, defined purpose, and the data subject is told what that purpose is.
- Further processing limitation — information isn't reused for a new purpose incompatible with the original one it was collected for.
- Information quality — reasonable steps are taken to keep personal information accurate, complete, and up to date.
- Openness — data subjects can find out what information you hold about them and why (usually via a privacy notice / PAIA manual).
- Security safeguards — appropriate technical and organisational measures protect personal information against loss, damage, and unauthorised access.
- Data subject participation — individuals can request access to, correction of, or deletion of their own personal information.
Appoint an Information Officer
Every responsible party must have an Information Officer — by default, this is the CEO or most senior person in the organisation unless someone else is formally designated. The Information Officer is responsible for encouraging compliance, handling access requests, and being the point of contact for the Information Regulator. Crucially, the Information Officer (and any deputies) must be registered with the Information Regulator — this is a step many smaller businesses miss entirely.
Have a PAIA manual
The Promotion of Access to Information Act (PAIA) works alongside POPIA: your organisation needs a PAIA manual explaining what records you hold and how someone can request access to them. Since 2021, PAIA manuals must also be submitted to the Information Regulator, not just made available on request.
Know your breach notification duty
If personal information is compromised — a data breach, unauthorised access, or accidental disclosure — POPIA requires you to notify both the Information Regulator and the affected data subjects "as soon as reasonably possible" after discovering the breach. There's no fixed statutory deadline like GDPR's 72 hours, but "as soon as reasonably possible" has been interpreted strictly in practice — waiting weeks to investigate before notifying anyone is a common and costly mistake.
Where businesses actually fall short
In practice, the gap usually isn't in understanding the law — it's in proving compliance when asked. Common failure points:
- No formal record of which systems and vendors process personal information (a data/processing inventory).
- Consent language that's technically present but not specific enough to satisfy the processing limitation condition.
- No documented security safeguards — policies exist but there's no evidence they're actually followed (access logs, encryption records, incident response drills).
- An Information Officer appointed on paper but never registered with the Information Regulator.
- Vendor/operator agreements (the equivalent of GDPR's data processing agreements) that were never actually signed or reviewed.
Penalties for non-compliance
POPIA gives the Information Regulator real enforcement teeth: administrative fines of up to R10 million, and in serious cases, criminal liability with imprisonment of up to 10 years. Enforcement has been increasing year over year, which is exactly why "we'll formalise this later" has become a genuinely risky position to hold.
This guide is general information, not legal advice — POPIA compliance obligations can vary based on your specific processing activities and sector. Consult a qualified professional for advice specific to your organisation.
Turning this into an ongoing practice
The eight conditions above aren't a one-time project — they're an ongoing operational discipline: new vendors need review, new data flows need documenting, and evidence needs to stay current, not just exist once. ComplianceDesk's POPIA framework gives you every one of these conditions pre-built as trackable controls, with an evidence vault and reminders before anything falls overdue — so proving compliance is a live system of record, not a folder you dig through once a year.