POPIA, PAIA compliance · 01
POPIA readiness: non-profit or small organisation
A personal-information inventory and data-flow map; a lawful-basis assessment against the eight conditions; the policy suite: privacy notice, internal processing policy, retention schedule,…
A personal-information inventory and data-flow map; a lawful-basis assessment against the eight conditions; the policy suite: privacy notice, internal processing policy, retention schedule, direct-marketing procedure, data-subject request procedure and forms; the operator register and the agreements to go with it; a security-compromise procedure with notification templates for the Regulator and for data subjects; Information Officer and deputy registration; the PAIA section 51 manual; and staff training material.
NPOs and small organisations, typically after a funder, a client or a bank has asked the question in writing.
The operator register is almost always the real gap. The clause is easy; identifying every third party that touches personal information is not. Start with the payroll bureau, the cloud host, the marketing agency, the shredding company and the IT support firm.
The law it sits under
The framework this work answers to.
POPIA is built on eight conditions for the lawful processing of personal information, set out in sections 8 to 25: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. Section 55 and the POPIA Regulations set the Information Officer’s duties, and the Information Officer must be registered with the Information Regulator. The Regulator may impose an administrative fine not exceeding R10 million, and certain contraventions are offences carrying up to ten years’ imprisonment.
How the engagement runs
What you are committing to.
A processing inventory is built first: what personal information the organisation holds, why, on what lawful basis, where it sits and who it goes to. From that follow the operator register and the section 21 agreements, the retention schedule, the data-subject request procedure with its forms, the breach procedure with the section 22 notification path, and the internal policy. The Information Officer is registered and the delegation of any deputy recorded.
Readiness is proved by records, not by a policy. The organisations that come through an assessment cleanly are the ones that can produce the inventory, the consent or lawful-basis record, the operator agreements and the request log, not the ones with the longest privacy policy.
Related pages, tools and documents
The self-checks and working documents below are free, need no email address, and are the quickest way to judge the work before commissioning any of it.
Start here
Tell us the decision your organisation needs to make.
The first conversation is thirty minutes, confidential and free. You will leave it knowing which of our services you need and which you do not.