POPIA self-assessment vs audit: what do you need?
A POPIA self-assessment helps you record possible gaps from your own answers. An audit examines agreed evidence against defined criteria. The depth of that review depends on its scope. POPIA Check provides a starting assessment and practical report; it does not issue a compliance certificate.
By POPIA Check · Editorial update · General information, not legal advice
Choose the depth of review you need
| Approach | Useful when | Check the limits |
|---|---|---|
| Self-assessment or gap assessment | You need an initial action list and a way to organise questions. | Answers may be incomplete. Findings are not independently verified. |
| Evidence-based audit | You need someone to examine how particular controls operate. | Agree records, systems, sampling, criteria, reviewer competence and exclusions. |
| A certification claim | A provider offers a certificate or badge. | Ask who issues it, against which scheme, what was assessed and when it expires. A badge does not settle your legal obligations. |
Start with one concrete business activity
Imagine a team sends customer lists to a marketing supplier. A questionnaire can flag uncertainty about supplier controls. A deeper review could examine the contract, actual exports, access permissions and an opt-out test. The same topic produces different evidence at each level. Use the assessment to decide which uncertainty deserves that closer look.
Prepare a review brief
- Name the processes and systems you want reviewed, plus the questions you need answered.
- Collect redacted examples and restricted references. Do not email whole customer lists as background material.
- Ask the reviewer to explain sampling and distinguish a document review from testing real behaviour.
- Agree the deliverable: findings, priority, evidence, owner and how remediation will be checked.
- Confirm scope, fees and any claimed assurance before engaging a provider.
What the free assessment gives you
POPIA Check covers eight areas with 40 core questions and relevant follow-ups. Allow around 15 to 20 minutes. You receive a PDF gap report and an action checklist. Name, company and email are requested at the end; partner contact and report sharing remain optional.
An impact assessment is a different exercise
A personal information impact assessment examines an activity's information flows, risks and safeguards. A broad readiness score cannot stand in for that work. Use the separate impact-assessment guide when you need to investigate a process or planned change.
Sources and further reading
Editorial guidance from POPIA Check, with links to primary sources. Ask your selected legal partner how the law applies to your organisation.
Gather the evidence. Assign the actions.
Download seven editable registers with examples and step-by-step instructions.
Get the free starter toolkitKnow what to work on next.
Get a free PDF gap report, then decide whether to discuss it with your chosen partner.
Start free assessmentView a sample report