Free POPIA compliance checklist for South African businesses
Organise the evidence behind your privacy practices. Record a status, owner and next step for each area, then download your free working copy. This checklist does not certify compliance.
By POPIA Check · Editorial update · General information, not legal advice
Your evidence and next steps.
0 of 10 areas reviewed. Progress, not a compliance score.
No email needed. Saved only in this tab for 24 hours. Nothing is sent to us or a partner. Use document references, not sensitive details. Download a copy to keep it.
01AccountabilityNot reviewed
Evidence to gather: Information Officer details, registration evidence and responsibilities
First action: Confirm who owns each privacy decision.
02Information flowsNot reviewed
Evidence to gather: Processing register covering customers, staff and suppliers
First action: Map one end-to-end collection workflow.
03Lawful processingNot reviewed
Evidence to gather: Documented purposes and relevant lawful grounds
First action: Review unnecessary fields and explain each purpose.
04Notices and transparencyNot reviewed
Evidence to gather: Current collection notices and publication locations
First action: Compare the notice with actual processing.
05RetentionNot reviewed
Evidence to gather: Retention schedule, exceptions and disposal records
First action: Identify overdue records for a justified review.
06Suppliers and operatorsNot reviewed
Evidence to gather: Contracts, access arrangements and security expectations
First action: Identify every supplier handling personal information.
07SafeguardsNot reviewed
Evidence to gather: Access reviews, backup procedures and risk records
First action: Review privileged access and restore readiness.
08IncidentsNot reviewed
Evidence to gather: Escalation route, response plan and notification process
First action: Walk through a realistic suspected compromise.
09Rights requestsNot reviewed
Evidence to gather: Access and correction routes, identity checks and records
First action: Test how a request reaches the right person.
10Higher-risk activitiesNot reviewed
Evidence to gather: Marketing, transfers, children and special information records
First action: List activities needing a targeted legal review.
Answer the 40 assessment questions. Your report identifies actions from your answers, with a separate checklist you can download and assign to your team.
Start the free self-assessmentHow to use the checklist
- For each area, record the evidence location, owner, gap, next action and target review date.
- Separate a missing document from a control that exists but has not been tested.
- Treat Not sure as a request to investigate. Do not guess to improve a score.
- Start with live data exposure, incidents and accountability before cosmetic policy changes. An actual incident needs prompt professional attention.
What this checklist cannot establish
This is an organising aid. The applicability of specific requirements depends on your processing activities and the law. It does not establish that your notices, contracts, security measures or notification decisions are sufficient, and it does not replace an assessment of PAIA or other applicable obligations.
Turn your review into a usable report
Complete the free POPIA Check assessment to capture your responses, see section-level priorities and receive a PDF to work through with your team. You can then choose Lawbella's available legal contact and authorise a report handover for a discussion about scope, availability and fees.
Sources and further reading
Editorial guidance from POPIA Check, with links to primary sources. Ask your selected legal partner how the law applies to your organisation.
Know what to work on next.
Get a free PDF gap report, then decide whether to discuss it with Lawbella.
Start free assessmentView a sample report