FREE WORKING DOCUMENTS · NO SIGN-UP

Your POPIA starter toolkit.
Put it to work.

Seven practical working documents to organise your evidence, assign actions and prepare for a focused privacy review.

Version 1.0 · 18 October 2026 · Excel, CSV and PDF

01

Map one real workflow

Choose an enquiry, application or order. Follow it from collection to deletion. Use the information inventory, then list the suppliers and retention decisions behind it.

02

Assign and test

Give each gap an owner and target date in the action plan. Test a rights request, an opt-out and a suspected incident using fictional details. Record the evidence of what worked.

03

Review and repeat

Complete the 40-question assessment using the evidence you have gathered. Discuss uncertain decisions with an adviser. Revisit the registers when systems, suppliers or purposes change.

CHOOSE THE DOCUMENT YOU NEED

Seven tools. One practical workflow.

Start with the inventory. Expand each tool for instructions and an example.

01Information inventoryUnderstand your information

Record one row per processing activity so you can explain what you collect, why it is needed, who sees it and when it should be reviewed.

Put it to work

  1. List an actual activity, not just a database. Include paper files, inboxes, exports and staff devices where relevant.
  2. Describe categories of people and information. Record special personal information or children's information as a review flag without copying the underlying records.
  3. Explain the purpose and proposed lawful ground, then link to the review decision. Consent is not a universal default.
  4. Trace internal access, external recipients, storage countries and the retention rule. Link missing evidence to an action owner.

What useful completion looks likeA colleague can follow the activity end to end, locate the notice and evidence, and see who owns every unresolved decision.

See all 13 fields
  • Activity reference
  • Activity and purpose
  • People and information categories
  • Collection source and notice reference
  • Lawful ground and review reference
  • Systems and storage locations
  • Internal access roles
  • Recipients and sharing purpose
  • Cross-border locations and review
  • Retention rule reference
  • Owner
  • Review date
  • Gap and next action

A populated register does not validate a lawful ground, cross-border arrangement or special-information exception. Ask an adviser to review uncertain activities.

Reference: POPIA sections 9-18, 19-21, 26-35 and 72.

02Supplier and operator registerKnow who handles it

Bring service providers, access arrangements and contract checks into one place. Distinguish suppliers acting on your instructions from organisations deciding their own purposes.

Put it to work

  1. Start from the inventory and include cloud tools, outsourced payroll, marketing, IT support and document storage.
  2. Record the provider's actual role for each activity. A contract label alone does not settle responsibility.
  3. Locate written terms, security obligations, subprocessors and international locations. Record evidence dates and gaps.
  4. Verify the incident contact and how access is removed, data returned or deleted when the arrangement ends.

What useful completion looks likeEvery relevant provider has a named owner, a located agreement and a clear action for any missing security, location or exit evidence.

See all 13 fields
  • Supplier reference
  • Supplier and service
  • Linked activity references
  • Information and access scope
  • Role and responsibility review
  • Storage countries and subprocessors
  • Agreement and security clause reference
  • Safeguards evidence
  • Incident contact route
  • Return or deletion arrangements
  • Owner
  • Review date
  • Gap and next action

This is a review register, not an operator agreement. Have the applicable contractual safeguards and transfer arrangements assessed.

Reference: POPIA sections 19-21 and 72.

03Retention and disposal worksheetKeep only what is justified

Document the reason and trigger for keeping each record category, who approves it and how disposal or restriction will work.

Put it to work

  1. Use record categories rather than one blanket period for the whole business.
  2. Record both the period and when the clock starts. Locate the legal obligation or documented justification behind the decision.
  3. Cover duplicates, email, devices, archives and backup cycles. Check holds, disputes and restrictions before disposal.
  4. Record approval, the disposal method and evidence of completion. Review when the purpose, law or system changes.

What useful completion looks likeA person responsible for disposal can identify which records are due, why, and what checks must be completed before acting.

See all 12 fields
  • Retention reference
  • Record category and linked activity
  • Purpose and required record
  • Period and start trigger
  • Legal or business justification reference
  • Decision owner and approval date
  • Systems and copies covered
  • Hold or restriction review
  • Disposal or de-identification method
  • Next review date
  • Disposal evidence reference
  • Gap and next action

No universal period is supplied. Confirm applicable legal duties and holds before deletion. Do not assume a request always requires immediate erasure.

Reference: POPIA section 14 and applicable sector record-keeping rules.

04Security incident and decision logAct promptly and keep a record

Create a factual timeline for suspected unauthorised access or acquisition and the decisions taken by your Information Officer and response team.

Put it to work

  1. Escalate a suspected compromise immediately through your internal response route. Preserve evidence securely and take appropriate containment steps.
  2. Record known facts, timestamps, unknowns and decisions. Keep sensitive evidence outside this summary log with restricted access.
  3. Have the responsible team assess notification to the Regulator and affected people as soon as reasonably possible. An operator should immediately notify its responsible party.
  4. Use the Regulator's current process and forms where required, record references and updates, then track corrective actions.

What useful completion looks likeThe response team can reconstruct what happened, when it was escalated, what decisions were taken and what remains outstanding.

See all 13 fields
  • Incident reference
  • Discovery date and time with zone
  • Reporter role and secure evidence reference
  • Known facts and information categories
  • Systems and affected groups
  • Containment actions and times
  • Information Officer escalation time
  • Notification assessment and reasons
  • Regulator notification reference and time
  • Affected-person notification reference and time
  • Outstanding facts and next update
  • Owner
  • Closure and corrective action reference

An active incident must not wait for this worksheet, a completed investigation or the ordinary 48-hour partner referral response. This log does not replace statutory notification or an incident response plan.

Reference: POPIA section 22; Information Regulator security compromise guidance and current notification process.

05Rights request trackerMake requests manageable

Track access, correction, deletion and objection requests from receipt to a documented response without exposing the underlying personal information.

Put it to work

  1. Record the request and route it promptly to the responsible owner. Use a reference instead of a name or identity document.
  2. Confirm the scope and a proportionate way to verify identity. Ask for only the information needed for verification.
  3. Check the applicable POPIA or PAIA procedure, deadline, exceptions and any supplier assistance. Do not assume one deadline fits all requests.
  4. Record the decision, secure response, any review route and the evidence that required updates reached relevant systems.

What useful completion looks likeEach request has a responsible owner, a confirmed process and target date, plus an auditable response and closure reference.

See all 11 fields
  • Request reference
  • Received date and route
  • Request type and scope
  • Secure identity-check reference
  • Applicable process and deadline review
  • Owner
  • Systems and suppliers to consult
  • Decision and reasons reference
  • Response date and secure delivery reference
  • Review or complaint information given
  • Follow-up and closure date

The tracker does not decide whether a request must be granted or what fee, exception or deadline applies. Confirm these for the particular request.

Reference: POPIA sections 23-25 and the applicable PAIA procedure.

06Marketing permission reviewCheck the audience and the route

Review each campaign's list source, relevant permission or exception and the practical ability to stop unwanted messages.

Put it to work

  1. Record the actual channel and how the audience was collected. Separate service messages from promotional campaigns.
  2. Locate evidence for the applicable permission or exception and its conditions. A purchased list or prior enquiry is not automatic permission.
  3. Check sender identification, notices and a practical objection or opt-out route. Test the process end to end.
  4. Confirm suppression survives re-imports, agency handovers and system changes. Record the review before sending.

What useful completion looks likeThe owner can explain who may receive the campaign, show the supporting evidence and demonstrate that opt-outs take effect.

See all 12 fields
  • Campaign reference
  • Purpose and communication channel
  • Audience and list source
  • Applicable rule and review reference
  • Permission or exception evidence
  • Notice and message identity reference
  • Opt-out route and test date
  • Suppression-list process
  • Agency or platform access
  • Owner
  • Review date
  • Decision and next action

This is not a consent form or a legal decision engine. Use the current Regulator guidance and applicable forms when assessing the campaign.

Reference: POPIA sections 11, 18 and 69; Information Regulator direct marketing guidance.

07Action and evidence planTurn findings into work

Convert gaps from your registers, assessment or website report into owned actions with completion evidence and a review decision.

Put it to work

  1. Give each action a stable reference and link it to the original finding. Describe the practical consequence of leaving it open.
  2. Assign an owner, a reasoned priority and a realistic date. Escalate active exposure or incidents through the urgent response route.
  3. Define the evidence that will demonstrate the action worked, not only that a document was created.
  4. Have an appropriate reviewer verify the result. Keep blocked items and dependencies visible and revisit changes.

What useful completion looks likeAnother person can see what must change, who owns it and how completion will be demonstrated.

See all 11 fields
  • Action reference
  • Source finding or register reference
  • Gap and practical impact
  • Priority and reason
  • Action and expected outcome
  • Owner
  • Target date
  • Status
  • Completion evidence reference
  • Reviewer and verification date
  • Next review or dependency

Completion counts are work progress, not a compliance score. Keep unresolved legal decisions visible even when operational tasks are finished.

Reference: Practical implementation worksheet linked to the eight POPIA processing conditions.

Keep your working files under your control.

Keep completed files in your organisation's controlled storage. Record process names and restricted document references, not ID numbers, passwords, full customer records or incident evidence. Downloads are blank: nothing you enter offline is sent to POPIA Check or a partner.

Open the workbook in Excel or import it into your organisation's approved spreadsheet service. If formatting or dropdowns are not supported, use the CSV files. CSV files contain column headings only; the workbook includes instructions, blank working rows and separate examples. Store new rows in the same table and check your access permissions before sharing.

A few useful answers

How is this different from the POPIA checklist and assessment?

The working checklist helps you identify evidence to gather. This toolkit provides documents for doing and recording the work. The 40-question assessment produces a personalised gap report and action checklist from your answers.

Will these documents make my business compliant?

General organising tools, not legal templates, certification or legal advice. Adapt them to your activities and have legal decisions reviewed by a qualified adviser. No fixed retention period or automatic notification deadline is assumed. They do not replace a privacy notice, operator agreement, formal rights response or required notification.

Can I share the pack with my team or clients?

Yes. You may adapt the working documents for your own or your clients' internal business use. Keep the source and scope notes with shared copies. Do not present the pack as an official Regulator document, a certification or a legal approval.

Does downloading start a partner referral?

No. A download does not create an assessment or share a report. After completing an assessment, you can select a named partner and expressly authorise a handover.

MAKE IT RELEVANT TO YOUR BUSINESS

Start with your everyday workflow.

Estate agenciesFollow property enquiries, tenant applications and buyer records through your estate agency. Get a practical POPIA checklist, free registers and a self-assessment.Read the guideRecruitment agenciesReview CVs, talent pools, client handovers and screening in a recruitment business. Use practical POPIA steps, free working templates and a 40-question assessment.Read the guideOnline shopsA practical POPIA guide for South African online shops. Review checkout, couriers, plugins, customer marketing and retention, with free templates and website checking.Read the guide

Sources and editorial scope

AI-assisted practical guidance from POPIA Check. Primary source links checked on 18 October 2026. These materials have not been presented as a legal partner's reviewed advice. Confirm current requirements and decisions with a qualified adviser.

Turn your evidence into a clear set of priorities.

Answer 40 questions across eight POPIA areas. Get a free report, then choose whether to discuss it with a named partner.

Start free POPIA assessmentCheck my website