POPIA, PAIA compliance · 02
POPIA remediation: public entity under an enforcement notice
Everything in the readiness programme, plus the remediation plan mapped clause by clause to the notice, the evidence register that proves each step was taken, and the response pack drafted and ready…
Everything in the readiness programme, plus the remediation plan mapped clause by clause to the notice, the evidence register that proves each step was taken, and the response pack drafted and ready for the Information Officer’s signature.
Public entities and larger organisations facing an enforcement notice or a complaint, where a deadline is already running.
The Information Regulator has moved from guidance to enforcement, and the recent notices were triggered by incident reports rather than complaints: reporting a breach now invites an assessment of the processing behind it. Ninety days is not enough time to build a compliance programme. It is enough to evidence one that already exists, which is why the evidence register matters more than the policies.
The law it sits under
The framework this work answers to.
Section 95 of POPIA empowers the Information Regulator to serve an enforcement notice requiring a responsible party to take specified steps within a specified period, or to stop processing. Failure to comply with an enforcement notice is an offence. An enforcement notice is therefore not a finding to be argued with after the fact; it is a deadline with a criminal consequence attached, and the only sensible response is a remediation plan that maps every directed step to evidence.
How the engagement runs
What you are committing to.
The notice is broken down directive by directive into a remediation plan with an owner, a deadline inside the Regulator’s period and a defined evidence artefact for each. The instruments the notice requires (revised policies, risk and impact assessments, security measures, notification to data subjects) are drafted, and the response to the Regulator is compiled as an evidence bundle rather than a letter of assurance.
The period in an enforcement notice runs from service, not from when the organisation finishes deciding who owns the problem. The first week is usually lost to that question, and the plan is built to remove it.
Related pages, tools and documents
The self-checks and working documents below are free, need no email address, and are the quickest way to judge the work before commissioning any of it.
Start here
Tell us the decision your organisation needs to make.
The first conversation is thirty minutes, confidential and free. You will leave it knowing which of our services you need and which you do not.