Self-assessment
POPIA Compliance Self-Assessment
36 yes/no questions across the eight POPIA conditions for lawful processing, plus PAIA, direct marketing and cross-border transfers. You get a score for each area and a list of gaps, each with the template or action that closes it.
1. Accountability
Someone must be responsible for POPIA in your organisation, and the effort must be visible.
1. Has your organisation appointed an Information Officer and registered them with the Information Regulator?
By default this is the head of the business, but the registration still has to be done. (POPIA s55)
2. If you need them, have Deputy Information Officers been appointed?
(POPIA s56)
3. Do you have a written compliance framework: policies, procedures and named responsibilities for POPIA?
(POPIA s8 and the Regulations)
4. Have employees had POPIA awareness training in the last 12 months?
(POPIA Regulations)
5. Do you review your privacy policies and procedures at least once a year?
2. Processing limitation
Collect only what you need, for a lawful reason, and do not keep it for ever.
1. For each type of personal information you collect, can you state the lawful reason (contract, legal duty, legitimate interest or consent)?
(POPIA s11)
2. Do you collect only the personal information you actually need for the purpose?
(POPIA s10)
3. Do you have a retention schedule, and do you delete or de-identify information when it is no longer needed?
(POPIA s14)
3. Purpose and further processing
Tell people why you collect their information and stick to that purpose.
1. Do you tell people why you are collecting their personal information when you collect it?
(POPIA s13, s18)
2. Before you use information for a new purpose, do you check that it is compatible with the original purpose or get fresh consent?
(POPIA s15)
3. Where you rely on consent, do you keep a record of who agreed, when and to what?
(POPIA s11)
4. Information quality
1. Do you have measures to keep personal information accurate, complete and up to date?
(POPIA s16)
2. Do you have a process to correct information when someone asks?
(POPIA s24)
5. Openness
Be open about what you hold, who sees it and where it goes.
1. Do you keep a record of your processing activities: what information, why, where it is stored, who can see it?
(POPIA s17)
2. Do you have a clear privacy notice that people can easily find?
(POPIA s18)
3. Does your privacy notice say who you share information with, including any transfers outside South Africa?
(POPIA s18, s72)
6. Security safeguards
Protect the information, and make sure suppliers do too.
1. Have you identified and assessed the risks to the confidentiality and integrity of personal information you hold?
(POPIA s19)
2. Have you put in place technical measures such as access controls, encryption, backups and patching?
(POPIA s19)
3. Do you check regularly that your security measures work, through testing or review?
(POPIA s19)
4. Is access to personal information limited to people who need it for their job?
(POPIA s19)
5. Do you have written agreements with every supplier that processes personal information for you?
(POPIA s20, s21)
6. Do you have a written plan for responding to a security compromise (data breach)?
(POPIA s22)
7. Do you log, investigate and document every security incident, including near misses?
(POPIA s22)
8. Do your staff know how to recognise a security incident and who to report it to?
(POPIA s22)
7. Data subject participation
People have the right to see, correct and delete their information, and to object.
1. Do you have a procedure for people to ask what information you hold about them and get a copy?
(POPIA s23)
2. Do you have a procedure for people to ask you to correct or delete their information?
(POPIA s24)
3. Can people object to the processing of their information, including by opting out of direct marketing?
(POPIA s11(3), s69)
4. Do you check a person's identity before giving them or changing their information?
5. Do you answer requests within the time the law allows?
(POPIA, PAIA)
6. Can people complain to you, and do you tell them they can also complain to the Information Regulator?
(POPIA s74)
8. PAIA, marketing, transfers and records
The rest of what an organisation is expected to show.
1. Do you have a PAIA manual that is published and kept up to date?
(PAIA s51)
2. Do you send direct electronic marketing only to people who have opted in, or to existing customers with a clear opt-out?
(POPIA s69)
3. If you send personal information outside South Africa, do you have a lawful basis for the transfer?
(POPIA s72)
4. Do you take extra care with special personal information (such as health or biometrics) and children's information?
(POPIA s26 to s35)
5. Do you do a short impact assessment before starting new projects that use personal information?
(POPIA Regulations)
6. Do you keep records that show how you comply: policies, training, requests, incidents and reviews?
(POPIA s8)
Sources
Turn these gaps into tracked tasks
Assign owners and due dates, keep the evidence, and show your progress to clients and auditors.