Personal information impact assessment vs POPIA readiness check
A personal information impact assessment looks closely at a processing activity, its risks and safeguards. A general POPIA readiness check records answers about wider business controls. The two can inform each other, but a readiness score is not an impact assessment.
By POPIA Check · Editorial update · General information, not legal advice
Why this distinction matters
Regulation 4(1)(b) requires the Information Officer to ensure a personal information impact assessment is done. The aim is to establish whether adequate measures and standards support the lawful-processing conditions. The 2025 amendments retain that provision. A public website scan cannot examine all the underlying activity.
Prepare the assessment brief
- Describe the activity and the decision the assessment should inform.
- Map the information, people, systems, recipients and countries involved.
- Explain the purpose and alternatives, including whether less information would work.
- Record potential harms, the people affected and the safeguards to examine.
- Identify missing evidence, the responsible reviewers and issues requiring specialist advice.
- Record decisions, residual concerns, actions and when the assessment should be revisited.
Worked example: moving candidate screening to a new provider
A recruiter plans to add a screening service. The review team maps what leaves the applicant-tracking system, what the provider adds, who sees the results and how decisions are made. They compare a smaller data transfer with the proposed full-file upload. Unresolved screening, hosting and retention questions become decisions to resolve before rollout. The example illustrates a review process; it does not approve the service or a lawful ground.
Evidence that makes the discussion useful
| Bring | Use it to examine |
|---|---|
| A diagram of the actual information flow | Where information enters, moves and leaves the activity. |
| Redacted field and output examples | Necessity, accuracy and potentially harmful inferences. |
| Supplier terms and service configuration | Responsibilities, access, hosting and incident arrangements. |
| Decision and action record | Who accepted, changed or escalated the proposed approach. |
How POPIA Check can help you prepare
Use the self-assessment to surface uncertain controls and the starter toolkit to organise an inventory and action plan. Take that preparation to an appropriately qualified adviser for the specific activity. Do not present the free PDF as a completed personal information impact assessment.
Sources and further reading
Editorial guidance from POPIA Check, with links to primary sources. Ask your selected legal partner how the law applies to your organisation.
Gather the evidence. Assign the actions.
Download seven editable registers with examples and step-by-step instructions.
Get the free starter toolkitKnow what to work on next.
Get a free PDF gap report, then decide whether to discuss it with your chosen partner.
Start free assessmentView a sample report