Information, data and records policies · 01
Information governance and POPIA policy
Records how the organisation processes personal information, and by what lawful basis.
Records how the organisation processes personal information, and by what lawful basis.
Build it on an inventory and data-flow map, not on a template: what personal information is held, where it lives, who touches it and why. Then state the lawful basis for each purpose against the eight conditions; the roles of the Information Officer and deputies and their registration; the rights of data subjects and how requests are handled; the operator register and the agreements behind it; special personal information and children’s information; direct marketing; cross-border transfers; security safeguards; retention; and the training cycle.
The operator register is almost always the real gap — the clause is easy, identifying every third party that touches personal information is not. Start with the payroll bureau, the cloud host, the marketing agency, the shredding company and the IT support firm. And consent is the lawful basis organisations reach for first and can rely on least: it must be voluntary, specific and informed, and it can be withdrawn, which makes it the weakest foundation for processing the business depends on.
The law it sits under
What governs this instrument.
POPIA is built on the eight conditions for lawful processing in sections 8 to 25 of the Protection of Personal Information Act 4 of 2013: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. A policy that restates the conditions without mapping them to this organisation’s own processing is evidence of nothing.
Related pages, tools and documents
Where this instrument sits in the wider set, and the engagement that produces it.
Start here
Tell us the decision your organisation needs to make.
The first conversation is thirty minutes, confidential and free. You will leave it knowing which of our services you need and which you do not.