What is POPIA? A practical business guide

Who should take a closer look?

POPIA's application depends on the Act's scope, exclusions and the circumstances of processing, rather than simply business size. Customer records, staff files, enquiry forms, supplier contacts and mailing lists are common places to start. Personal information can relate to an identifiable living natural person and, where applicable, an identifiable existing juristic person.

The eight conditions for lawful processing

• Accountability: identify responsibility for putting the conditions and relevant measures into practice.
• Processing limitation: consider lawful grounds, minimality, collection sources and the circumstances of collection. Consent is one possible ground, not the only ground.
• Purpose specification: document why information is collected and the applicable retention or disposal rules.
• Further processing limitation: assess whether later uses are compatible with the original purpose or otherwise permitted.
• Information quality: take reasonably practicable steps appropriate to the purpose to keep information complete, accurate, not misleading and updated where necessary.
• Openness: maintain the required documentation and consider what people must be told about collection.
• Security safeguards: identify foreseeable risks, apply appropriate safeguards and review operators and incident handling.
• Data subject participation: provide a route for access, correction and other applicable requests, subject to the Act's requirements and limits.

Move from a policy to evidence

Choose one real workflow, such as a new customer enquiry. Record the fields collected, the purpose and lawful ground, the staff and suppliers with access, storage locations, retention and the route for rights requests. Compare that record with what your notice says and what your team actually does.

• Keep the current notice and the forms on which it appears.
• Gather Information Officer registration evidence and assigned responsibilities.
• Check supplier terms, permissions, access reviews and staff training records.
• Record gaps with an owner and a review date instead of treating a template as proof of compliance.

A self-assessment starts the discussion

POPIA Check turns 40 answers into a structured gap report. It is designed to help prepare an informed remediation discussion. It does not inspect all evidence or determine whether every legal obligation applies. Special personal information, children's information, cross-border transfers, direct marketing and sector-specific rules can require a separate legal review.