The Protection of Personal Information Act (POPIA) has been fully enforceable since 1 July 2021, and the Information Regulator has since moved from warnings to enforcement notices and fines. Yet many South African small businesses still have no privacy policy, no registered Information Officer and no idea where their client data lives. This checklist shows you exactly what to do.
This article is general guidance, not legal advice. For complex processing (health data, children's data, cross-border transfers) consult a privacy attorney.
What is POPIA?
POPIA is South Africa's data protection law — similar in spirit to Europe's GDPR. It regulates how organisations collect, store, use, share and destroy personal information: names, ID numbers, contact details, banking details, health information, biometrics, CVs, CCTV footage and even opinions about a person. It gives individuals rights over their data and holds businesses accountable for protecting it.
Who Must Comply? (All SA Businesses)
If your business processes personal information about clients, employees, suppliers or website visitors, POPIA applies to you. That includes:
- Sole proprietors and one-person consultancies
- Retailers and e-commerce stores collecting delivery details
- Medical, dental and wellness practices (special personal information)
- Estate agents, accountants, law firms and financial advisors
- Schools, crèches, churches and NPOs
- Any business with employees — HR files are personal information
The 8 Conditions for Lawful Processing
- Accountability — the business is responsible for compliance, and must be able to prove it.
- Processing limitation — collect only what you need, lawfully, with consent or another legal justification.
- Purpose specification — collect data for a specific, defined purpose and keep it no longer than necessary.
- Further processing limitation — don't use data for a new purpose that is incompatible with the original one.
- Information quality — keep personal information accurate, complete and up to date.
- Openness — tell people what you collect and why (privacy notice, PAIA manual).
- Security safeguards — protect data with reasonable technical and organisational measures, and report breaches.
- Data subject participation — people can access, correct or request deletion of their data.
Fines and Enforcement
The Information Regulator can investigate complaints, conduct assessments, issue enforcement notices and impose administrative fines of up to R10 million. The most serious offences carry up to 10 years' imprisonment. Beyond fines, the real damage is often reputational: clients leave when their data leaks, and civil claims can follow. The Regulator has already issued fines and enforcement notices against public and private bodies for security failures and for failing to report breaches.
Practical POPIA Compliance Checklist (10 Items)
| # | Action | Done? |
|---|---|---|
| 1 | Appoint and register your Information Officer (and deputies) on the Information Regulator portal. | ☐ |
| 2 | Map your data — what personal information you hold, where it lives (email, M365, CRM, paper files) and who can access it. | ☐ |
| 3 | Publish a privacy policy on your website and update website forms with consent wording. | ☐ |
| 4 | Compile a PAIA manual and make it available on request or on your website. | ☐ |
| 5 | Secure your systems — MFA, endpoint protection, encrypted laptops, firewall, patched software. | ☐ |
| 6 | Back up securely — encrypted, access-controlled backups, ideally in South African data centres. | ☐ |
| 7 | Sign operator agreements with suppliers who process data for you (payroll, IT, cloud, marketing). | ☐ |
| 8 | Set retention and destruction rules — delete data you no longer need, shred paper securely. | ☐ |
| 9 | Write an incident response plan including breach notification to the Regulator and affected people. | ☐ |
| 10 | Train your staff annually on privacy, phishing and secure data handling — and keep attendance records. | ☐ |
Items 5, 6 and 9 are where most small businesses fall short — and they are exactly what the Regulator looks at after a breach. Our 2026 cybersecurity guide explains these controls in plain language.
How MBICT Helps You Become POPIA Compliant
MBICT is an IT company, so we focus on the part of POPIA most businesses struggle with: the technical security safeguards — and the evidence that proves them.
- POPIA IT gap assessment — we review your systems against section 19 and give you a prioritised action list.
- Security implementation — MFA, EDR, encryption, firewall and backups through our managed cybersecurity service from R6,500/month.
- Microsoft 365 data protection — data loss prevention, sensitivity labels and access reviews via our Microsoft 365 service.
- Website compliance — privacy policy page, cookie notice, SSL and consent-aware forms on your website.
- Documentation pack — information security policy, incident response plan and annual security report.
Get Your POPIA IT Gap Assessment
Find out exactly where your business stands — and what it takes to close the gaps — in one clear report. Johannesburg businesses can book an on-site assessment this week.