How the POPIA Check assessment and report work

What you answer

There are five questions in each of eight areas: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. Choose Yes, Partially, No or Not sure to describe controls currently in place. Allow about 10 to 15 minutes, depending on the evidence you have available.

How the score is calculated

Yes receives 1 point, Partially receives 0.5 and No or Not sure receives 0. Each section has a maximum of 5 points, and the overall score is the total out of 40 expressed as a percentage. Scores of 75 or more are labelled Stronger controls, 50 to 74 Needs attention and below 50 High risk. These are product-defined summary bands, not thresholds set by the Information Regulator. A high score can still contain a serious gap.

How priorities are chosen

The report highlights gaps in security and incident controls and Information Officer registration, then other No, Not sure and Partially responses. Suggested actions are mapped to the questions. They are a starting point for planning, not independently verified findings or a legal determination.

What the report contains

• An executive brief and overall self-assessment score.
• Eight section summaries and prioritised practical actions.
• A suggested 90-day starting plan for assigning work.
• All 40 answers with findings and suggested next steps.
• A checklist of documents and questions for a legal discussion.

Limits and topics needing a deeper review

The assessment does not independently verify documents, interview staff, test systems or decide every applicable legal requirement. Special personal information, children's information, cross-border transfers, direct marketing, prior authorisation, sector-specific requirements and PAIA can need additional questions and professional review. The website scan is a separate, limited evidence check.

Your report and your sharing choice

The free PDF is available after you submit your name, company, email and processing permission. It is also sent by email. You review the results before choosing whether to share. Lawbella is currently the available legal partner. Selecting a person and authorising the handover sends the full assessment, all responses and your contact details to that person, with confirmation to you. A referral does not itself establish a professional engagement.