POPIA Compliance Checklist for South African Businesses (2026)

Most South African organisations have a POPIA policy. Far fewer can prove POPIA compliance when asked. The Act does not reward documentation. It rewards demonstrable control over personal information.

Here is the checklist we work through with organisations that hold large stakeholder databases.

1. Know what you hold

You cannot protect what you have not mapped. List every place personal information lives: your operational system, spreadsheets, email inboxes, WhatsApp exports, old CRMs, and any file share. Record for each: what fields, whose data, why you hold it, and who can see it.

2. Establish a lawful basis for each purpose

Consent is one basis, not the only one. Contractual necessity, legal obligation and legitimate interest are often stronger and more defensible. Write the basis down per processing purpose, because "we always have" is not one.

3. Fix your consent capture

• Consent must be specific, informed and voluntary
• Marketing consent is separate from service consent
• You must be able to show when and how consent was given
• Withdrawal must be as easy as giving it

If your sign-up form does not timestamp and store the consent choice, you have a policy but no evidence.

4. Restrict access by role, not by trust

The most common POPIA failure in South African operations is over-access: every staff member able to see every stakeholder record. Access should be scoped to the role and the department that needs it, and revoked the day someone changes roles.

5. Log everything

Section 19 requires appropriate, reasonable technical and organisational measures. In practice, an auditor wants to see who viewed, changed, exported or deleted a record, and when. An audit log turns an argument into a report.

6. Set retention periods and actually enforce them

Personal information may not be kept longer than necessary. Decide the retention period per record type, then enforce it in the system. Indefinite retention "just in case" is a breach waiting for a request.

7. Handle data subject requests within days, not weeks

A data subject can ask what you hold, ask for correction, or ask for deletion. If answering means five people searching five systems, you will miss the deadline. One searchable record per person is the operational requirement behind the legal one.

8. Have a breach response you have rehearsed

POPIA requires notification of the Information Regulator and affected data subjects as soon as reasonably possible after a compromise. Write the runbook now: who decides, who drafts, who notifies, what evidence gets preserved.

9. Appoint and empower an Information Officer

Registration with the Information Regulator is required, but the real work is authority. An Information Officer who cannot change access rights or block a process is decorative.

10. Bind your operators in writing

Any third party processing personal information on your behalf, from a payroll bureau to a call centre, needs a written agreement covering security and confidentiality.

The operational shortcut

Nine of these ten items become easier the moment stakeholder information lives in one governed system instead of scattered files. Recenvy provides role-based access, department-level visibility, full audit logging, document retention, consent-capturing forms and self-service portals so data subjects can see and correct their own information. Compliance then becomes a report you run, not a project you survive.

This article is general guidance, not legal advice. Confirm your obligations with your compliance adviser.