POPIA compliance checker for small businesses

Every business that invoices a customer or pays an employee processes personal information, and the Protection of Personal Information Act applies to it. This checker sorts the duties you have actually triggered from the ones you have not, and puts them in the order to deal with them.

What this tool works out and who it is for

You answer ten questions: how many employees you have; whether you keep customer names, contact details, invoices or accounts; whether you send marketing by email, SMS, WhatsApp or automated calls; whether you hold health, biometric, religious, race, criminal or trade union information; whether you collect children's information; whether outside providers such as payroll, accounting, cloud storage or a web developer process your data; whether any of it sits outside South Africa; whether you use CCTV, fingerprint or facial recognition; and whether you have already registered an Information Officer and compiled a PAIA manual.

The tool gives you a line for each of twelve possible obligations, marked Applies or Not triggered, with a plain note on what each means for you. It counts the obligations that apply and the actions still outstanding, and writes you a to-do list in order.

It is for the owner of a small business, a sole trader, a practice, a school, a church, a body corporate or a non-profit. Anyone who handles other people's details and wants to know what the law actually asks, without buying software or a compliance package first.

How the checker decides

The tool works in two layers: the baseline duties, and the duties your answers switch on.

First it decides whether you process personal information at all. You do if you keep customer records, have any employees, send electronic marketing, hold special information, hold children's information or run cameras. If all of those are no, the tool says POPIA obligations are not triggered on your answers and warns you to check them, because a trading business with no personal information is rare.

Second, if you do process personal information, it switches on the four baseline duties that apply to everyone.

An Information Officer registered with the Information Regulator. The head of the business is the Information Officer by default and must register before performing the role. If you have not, registering goes to the top of your to-do list.

A PAIA manual, which every private body must have under the Promotion of Access to Information Act, available on request and on your website if you have one.

A privacy notice and a lawful basis for each purpose. You tell people what you collect, why, who receives it and how long you keep it, and you record the lawful ground for each purpose.

Security safeguards and a breach plan. Reasonable technical and organisational measures, which for a small business means access control, backups, encryption and staff training, plus a written plan for notifying the Regulator and the affected people after a security compromise, the Act's term for a breach.

Third it switches on the extra duties one by one from your answers.

Employees. If you have any staff, their payroll, ID numbers, health and disciplinary records are personal information. You need a staff privacy notice and limits on who sees HR files.

Direct marketing consent under section 69. Electronic marketing to anyone who is not an existing customer needs prior opt-in consent, asked for once, and every message needs a working opt-out. You need an opt-in record for prospects, an opt-out on every message and a suppression list.

Special personal information. Health, race, religion, biometrics, criminal behaviour, sexual life, political persuasion and trade union membership each need a specific lawful ground, usually consent, and restricted access.

Children's information. Processing a child's information needs the consent of a competent person, usually a parent or guardian, or another ground the Act allows.

Operator agreements. An operator is a third party that processes personal information on your behalf: payroll, hosting, marketing, cloud. Each one must be bound in writing to confidentiality and security.

Cross-border transfers. Personal information leaving South Africa, including to an overseas cloud service, needs one of the grounds the Act allows, such as adequate protection, consent or a contract. You check each provider's data location and record the ground.

CCTV or biometrics. Footage and fingerprints are personal information, and biometrics are special personal information. You need signage, a retention period and restricted access.

Fourth it builds the to-do list. Each triggered obligation not already done contributes one action, in the order above, so Information Officer registration always comes first, then the PAIA manual, the privacy notice, safeguards, and then the switched-on duties.

The warnings it can raise

There are three. If you answered no to everything, the tool tells you to check your answers. If you process personal information and have not registered the Information Officer, it reminds you that registration is the first thing the Regulator asks for in any complaint or investigation, and that it costs nothing. If you hold special or children's information, it warns that some processing of that kind, and some cross-border transfers, need the Regulator's prior authorisation before you start.

The eight conditions

Everything on the list is a way of meeting one of the eight conditions for lawful processing: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. The last one means people may ask what you hold about them, ask you to correct or delete it, and object to direct marketing, and you need a simple way to handle those requests in reasonable time.

The law behind it

The duties come from the Protection of Personal Information Act 4 of 2013, usually called POPIA. The eight conditions, special and children's information, operators, security compromises, cross-border transfers and the Regulator's powers are all in it. Section 69 is the direct marketing provision that requires opt-in consent for electronic marketing to people who are not existing customers. Section 22 is the provision that requires you to notify the Regulator and the affected people after a security compromise.

The PAIA manual comes from the Promotion of Access to Information Act 2 of 2000, which requires every private body to compile one. The Information Officer is registered with the Information Regulator, which also publishes the guidance notes and templates the tool refers to.

The Regulator can investigate complaints, issue enforcement notices and impose administrative fines, and some contraventions are criminal offences. For a small business, though, compliance is mostly documentation and habits.

Worked example

This example is illustrative. Lerato runs a hair salon with four employees. She keeps client names, numbers and appointment histories on a booking system, emails a monthly promotion to everyone who has ever booked or enquired, and uses a local payroll company to run wages. No health or biometric records, no children's details, no cameras, everything hosted in South Africa. She has not registered an Information Officer and has no PAIA manual.

She keeps customer records and has staff, so POPIA applies. That is obligation one. The four baseline duties all switch on: Information Officer, PAIA manual, privacy notice, safeguards. That is five. Four employees switches on the employee line. Six. The promotional emails switch on section 69 marketing consent. Seven. The payroll company is an operator. Eight. Special information, children, cross-border and cameras all show as not triggered.

The headline reads eight POPIA obligations apply, seven actions outstanding. The first obligation, that POPIA applies, carries no action. Her to-do list runs: register the Information Officer on the Regulator's portal; compile and publish a PAIA manual; write a privacy notice and a record of purposes; document safeguards and a breach plan; add a staff privacy notice and limit access to HR files; build an opt-in record, an opt-out on every email and a suppression list; and sign a written operator clause with the payroll company.

The marketing line deserves a second look. Clients who have booked are existing customers, and she may email them about similar services with an opt-out. People who only enquired are not, and she needs their opt-in before the next promotion goes out.

What this tool does not decide

The checker is a starting point, not a compliance certificate. The Information Regulator's guidance notes and codes of conduct can add duties for particular sectors, and its prior authorisation rules can require you to apply before you process certain special or children's information or make certain cross-border transfers.

It does not audit your systems, read your contracts or judge whether your safeguards are reasonable for the risk. It does not tell you whether a specific overseas provider offers adequate protection. Does POPIA apply to my small business covers the threshold question in more depth.

When to get advice, and the free route

Almost everything on your to-do list can be done free. The Information Regulator's portal registers your Information Officer at no charge, and its website publishes the PAIA manual template, guidance notes and the forms for prior authorisation and complaints. How to register an Information Officer with the Information Regulator walks through the first step, and can I send marketing emails and SMS under POPIA covers section 69 in detail.

Get advice from an attorney if you process health, biometric or children's information at scale, if you send data outside South Africa in volume, if you have had a security compromise, or if the Regulator has written to you. If you cannot afford an attorney, our legal aid page explains the free and low-cost options.

LawMatch is not a law firm and this page is general information, not legal advice. Check the Regulator's current guidance for your sector before you rely on it.

Frequently asked questions

Do I need an Information Officer if I am a sole trader?

Yes. If you process personal information, the head of the business is the Information Officer by default, and for a sole trader that is you. Registration is free.

What is a PAIA manual and do I really need one?

It is a short document describing your business, the records you hold and how someone can request access to them. Every private body must have one under the Promotion of Access to Information Act. The Regulator's template does most of the work.

Can I email my existing customers without their consent?

You may market your own similar goods or services to existing customers, provided every message carries a working opt-out. Anyone who is not an existing customer needs prior opt-in consent, asked for once.

Is my payroll or accounting provider my responsibility?

Yes. A provider that processes personal information on your behalf is an operator, and you must bind it in writing to confidentiality and security. You stay responsible for what it does.