Skip to main content
010 447 2445Contact
Arke Technologies home
Request a hardware quoteTalk to us
Arke Technologies home
An analyst in a headset watches monitoring dashboards across two screens in a daylight office.

POPIA compliance checklist for employers and organisations in South Africa

Last reviewed: September 2026

POPIA employer compliance in South Africa means handling every record you hold about staff, job applicants, customers and suppliers lawfully and securely. This POPIA compliance checklist sets out what organisations must do, from registering an Information Officer to reporting breaches, and where Arke Technologies in Johannesburg helps with the systems and security work.

Request a security assessmentSee POPIA compliance services
Insights

POPIA compliance checklist for employers and organisations in South Africa

Last reviewed: September 2026, 15 min read

POPIA employer compliance in South Africa means handling every record you hold about staff, job applicants, customers and suppliers lawfully and securely. This POPIA compliance checklist sets out what organisations must do, from registering an Information Officer to reporting breaches, and where Arke Technologies in Johannesburg helps with the systems and security work.

Last reviewed: September 2026, 15 min read

On this page

What POPIA requires of every organisation

The Protection of Personal Information Act 4 of 2013 (POPIA, often called the POPI Act) has been enforceable since 1 July 2021. It applies to every public and private body that processes personal information in South Africa, about customers, learners, patients, citizens or its own staff, and it protects existing companies and other juristic persons as well as individuals. The Information Regulator enforces it, together with the Promotion of Access to Information Act (PAIA).

Its core is eight conditions for lawful processing: the POPIA compliance requirements every organisation must meet, for paper records as much as for systems.

ConditionSectionsWhat it requires
1. Accountability8The organisation ensures that every condition is met
2. Processing limitation9 to 12A lawful basis, only the information needed, collected directly where possible
3. Purpose specification13 to 14A defined purpose, and records kept no longer than necessary
4. Further processing limitation15New uses compatible with the original purpose
5. Information quality16Complete, accurate and up-to-date information
6. Openness17 to 18Documented processing, and people told what is collected and why
7. Security safeguards19 to 22Reasonable technical and organisational measures, operator contracts and notice of compromises
8. Data subject participation23 to 25People can access and correct their information

POPIA also regulates special personal information and children's information (sections 26 to 35), electronic direct marketing (section 69), decisions based solely on automated processing (section 71) and transfers of personal information out of South Africa (section 72). This checklist is general guidance, not legal advice; your attorneys should confirm legal positions for your organisation.

Four colleagues gather around a desktop computer to work through an issue together.

POPIA employer compliance in South Africa: staff and applicant information

Every employer is a responsible party for its employees' personal information, and HR holds some of the most sensitive records in any organisation: identity numbers, bank and tax details, medical certificates, disciplinary records and, often, biometric clocking data. For employers, POPIA compliance comes down to five questions.

What is our lawful basis? Most HR processing rests on the employment contract or a legal obligation, such as payroll tax, UIF declarations and employment equity reporting, not on consent. Consent can be withdrawn, and employees may not feel free to refuse it, so keep it for genuinely optional processing such as staff photographs on your website.

Is special personal information handled correctly? Race (for employment equity reports), health, trade union membership, biometrics and criminal records are special personal information, allowed only with consent or a specific authorisation, such as complying with laws that advance people disadvantaged by unfair discrimination, or a right or obligation in law (sections 26 to 33).

How long do we keep records? No longer than the purpose and the law require (section 14). The Basic Conditions of Employment Act requires records of time worked and remuneration to be kept for three years (section 31), and the Tax Administration Act generally requires tax records to be kept for five years from the date a return is submitted (section 29). Then delete or destroy them securely, including stray copies in email and shared folders.

Do we monitor staff? Monitoring email, internet use, devices or CCTV needs a stated purpose, must be proportionate and should be disclosed in a policy employees have seen. The Regulation of Interception of Communications Act (RICA) also applies to intercepting communications, so take legal advice before monitoring message content.

How do we treat job applicants? Tell candidates what you collect and why, keep unsuccessful applicants' CVs only as long as you said you would, and get consent before criminal or credit checks. Section 71 restricts decisions based solely on automated processing that profiles a person, including their performance at work, so keep a person in any decision that screening software informs.

The POPIA compliance checklist

Use this POPIA compliance checklist to track progress. Each item names the evidence to keep, because compliance you cannot demonstrate is hard to defend.

Governance

  1. Appoint and register the Information Officer. By default this is the head of the organisation: for a company, the chief executive or equivalent; in a municipality, the municipal manager. Register them with the Information Regulator, through its eServices portal, before they take up their duties (section 55), and designate deputies where needed. Evidence: the registration confirmation and written designations.
  2. Build the compliance framework. Regulation 4 of the POPIA regulations, as amended in April 2025, requires the Information Officer to ensure that a compliance framework is developed, implemented, monitored, maintained and continually improved, that a personal information impact assessment is done, that internal measures and systems handle requests, and that awareness sessions are held. Evidence: the framework, the impact assessment and awareness records.
  3. Publish your PAIA manual, explaining which records you hold and how to request them (PAIA sections 14 and 51). Evidence: the current manual, online and at your offices.

Know your information

  1. Map the personal information you hold. For customers, staff, applicants, suppliers and visitors: what, where, why, who can see it and for how long, across email, shared drives, backups, paper and cloud applications. Evidence: a data inventory.
  2. Flag special and children's personal information, such as health, biometrics, race, union membership, criminal records, religious beliefs and anything about under-18s. Evidence: each item and its authorisation, recorded in the inventory.

Lawful processing

  1. Record a lawful basis for each purpose: consent, a contract, a legal obligation, the data subject's legitimate interest, a public body's public law duty, or the legitimate interest of your organisation or a third party (section 11). Evidence: a register of purposes and bases, with consent records where consent is the basis.
  2. Update your notices for customers, employees and job applicants, each covering what section 18 requires. Evidence: current notices and where each is published.
  3. Set and apply retention periods that meet section 14 and the laws that set minimum periods. Evidence: the retention schedule and deletion records.
  4. Check your direct marketing. Electronic marketing needs consent unless the person is an existing customer who was given the chance to opt out (section 69). Evidence: consent records and opt-out handling.

Security

  1. Secure personal information (section 19): identify the risks, put safeguards in place, verify regularly that they work and update them as risks change. Evidence: a risk assessment, policies, test results and a record of changes.
  2. Control your operators. Payroll bureaux, HR and cloud software providers and IT support companies need written contracts that require security measures and immediate notice of any compromise (sections 20 and 21). Evidence: signed operator agreements.
  3. Prepare for security compromises (section 22) with a written, rehearsed plan: who decides, who reports to the Information Regulator through its eServices portal, who tells the people affected, and how evidence is kept. Evidence: the plan, rehearsal notes and an incident log.

Rights, transfers and people

  1. Handle data subject requests for access, correction, deletion and objection through a documented process. Under the regulations as amended in April 2025, objections and correction or deletion requests are free of charge and must be accepted by any reasonably accessible means, with telephone requests recorded; PAIA allows 30 days to decide an access request (sections 25 and 56). Evidence: a request log.
  2. Control transfers out of South Africa (section 72). Know which cloud services store data abroad and the legal basis for each transfer. Evidence: a transfer register.
  3. Train staff and review every year, with deeper training for HR, finance and IT and an annual report to the board or council. Evidence: attendance records and the report.

Security safeguards: the technical side of POPIA

Section 19 is where POPIA meets IT. It requires appropriate, reasonable technical and organisational measures against the loss of, damage to or unauthorised destruction of personal information, and against unlawful access to it, with due regard to generally accepted information security practices. The controls that protect employee and customer information are well known:

  • Multi-factor authentication on email, HR, payroll and finance systems, with separate administrator accounts.
  • Least-privilege access, so payroll data is visible to payroll staff only, and leavers' accounts closed on their last day.
  • Encrypted laptops, phones and backups, and managed devices that can be wiped remotely.
  • Email security against phishing and fraudulent banking-detail changes, a known route to payroll and supplier fraud.
  • Patching and endpoint protection on every device and server.
  • Tested backups that attackers cannot reach, so ransomware does not become data loss.
  • Logging and monitoring, so a compromise is noticed and can be investigated.
  • Security awareness training, because many compromises start with one email.

These controls align with ISO/IEC 27001, a widely used example of the generally accepted practices section 19 refers to; see our guides to ISO 27001 certification and what cyber security is.

When personal information is compromised

POPIA section 22 applies as soon as there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. The response has five steps:

  1. Contain

    Stop the compromise: reset credentials, isolate affected devices and block the attacker's access.

  2. Preserve evidence

    Keep logs, emails and affected systems intact for the investigation, your insurer and, where needed, the police.

  3. Assess

    Establish what information was involved, whose it was and what harm could follow.

  4. Notify

    As soon as reasonably possible, report to the Information Regulator through its eServices portal (mandatory since 1 April 2025) and tell the people affected in writing, with enough information for them to protect themselves. Operators must tell you immediately (section 21).

  5. Learn

    Fix the cause, update the risk assessment and record what changed.

Our incident response service runs the technical side of this process and prepares the facts your Information Officer needs to notify.

POPIA non-compliance fines and other consequences

POPIA non-compliance fines are not theoretical. The Information Regulator can issue enforcement notices and administrative fines of up to R10 million (section 109). The most serious offences, such as obstructing the Regulator, failing to comply with an enforcement notice or misusing account numbers, carry a fine, up to ten years' imprisonment or both, and other offences up to 12 months (section 107). People whose information is mishandled can also claim damages in the civil courts (section 99).

The Regulator uses these powers. In July 2023 it fined a national government department R5 million for failing to comply with an enforcement notice issued after a ransomware attack, having found that licences for key security software had been allowed to lapse (Information Regulator, July 2023). The lesson for every organisation is section 19's requirement to verify, regularly, that safeguards still work.

  • R10 million

    maximum administrative fine (section 109)

  • Up to ten years' imprisonment for the most serious offences (section 107)

  • Eight conditions for lawful processing

Governance: POPIA at board and council level

The organisation, as the responsible party, is accountable for POPIA compliance. King V, which replaced King IV for financial years starting on or after 1 January 2026, places the governance of data, information and technology with the governing body, including the protection of personal information (Principle 10, successor to King IV's Principle 12). A short annual report from the Information Officer to the board or council, covering the framework, incidents, requests and open risks, shows whether the programme works. Public bodies add PFMA or MFMA disciplines, and their audit committees look for the same evidence. See technology governance under the King Code and PFMA, MFMA and ICT procurement.

How we help with POPIA compliance

We handle the systems and security side of POPIA; your Information Officer owns the programme and your attorneys confirm legal positions.

  • POPIA and security assessment

    We map where personal information lives across email, file shares, HR, payroll and cloud applications, test the safeguards and rank the risks in a written report.

  • Remediation

    Multi-factor authentication, leaver processes, encryption, retention settings, backups and email security, fixed in order of risk.

  • Records for the Information Officer

    System inventories, access reviews and security evidence for the compliance framework and the impact assessment.

  • Operator duties

    When we manage your systems we process personal information on your behalf: every remote session is approved and logged, and everyone with access is bound by confidentiality and our security controls.

  • Managed security

    Monitoring checks each managed computer every 15 minutes and logs faults as tickets automatically. Incidents are prioritised from P1 to P4 against targets agreed in your SLA, with a monthly service review and report.

  • Training and rehearsal for your staff and for your incident plan.

Our controls are aligned with ISO/IEC 27001 and the NIST Cybersecurity Framework. Arke Technologies is a Level 1 B-BBEE contributor (sworn affidavit available on request); company documents, our CSD number and tax compliance status are available on request, and your data, credentials and documentation stay yours. See our POPIA compliance service, cybersecurity and POPIA for schools, and how we apply the Act ourselves in our privacy notice and PAIA manual.

What POPIA compliance costs

Last reviewed: September 2026.

POPIA compliance costs fall into three groups: legal work on policies and notices; systems and security work, from assessment to remediation and monitoring; and people's time, especially the Information Officer's and HR's. The drivers are the volume and sensitivity of the personal information you hold, the number of systems and operators involved, and what is already in place.

We quote a POPIA and security assessment and the remediation per project, and managed security per user per month after the assessment. For comparison, published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026). Many organisations already pay for security features in Microsoft 365 or Google Workspace that were never switched on, so we check those first. See our guide to managed IT services cost and our other insights and guides.

Related services

Related guides

Get our guides by email

Plain, sourced guides for the people who decide on and buy technology, sent to your inbox.

Topics (optional)

Leave these clear to receive everything.

By signing up, you agree that Arke Technologies (Pty) Ltd may email you guides and updates. Every email includes an unsubscribe link. Read our privacy notice.

Frequently asked questions

How do you get POPIA compliant? Show answer

You get POPIA compliant by registering an Information Officer, mapping the personal information you hold, recording a lawful basis for each use, updating your notices and PAIA manual, securing the information, signing operator agreements and preparing for security compromises. Then review the framework every year and keep evidence that each step works.

What are the 8 requirements of the POPI Act? Show answer

The eight requirements of the POPI Act, which it calls conditions for lawful processing, are accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. Together they govern why and how much personal information you collect, how long you keep it, how you protect it and who can see it.

What does it mean to be POPIA compliant? Show answer

Being POPIA compliant means processing personal information in line with all eight conditions of the Act and being able to prove it. In practice that means a registered Information Officer, documented purposes and lawful bases, current notices, a PAIA manual, tested security safeguards, operator agreements, a breach plan and a record of requests handled.

Who is responsible for POPIA compliance? Show answer

The organisation, as the responsible party, is accountable for POPIA compliance, and its governing body oversees it. The Information Officer, by default the head of the organisation, leads the work and must be registered with the Information Regulator. Staff handle personal information within the rules, and operators such as payroll bureaux and IT providers must protect what they process.

What are some examples of POPIA violations? Show answer

Common POPIA violations include failing to secure personal information, sending marketing emails without consent, not reporting a security compromise, keeping records longer than necessary, sharing information with a supplier that has no operator agreement and ignoring access requests. Employer examples include payroll files open to all staff and former employees' accounts left active.

What are the fines for POPIA non-compliance? Show answer

The Information Regulator can impose administrative fines of up to R10 million (POPIA, section 109), and the most serious offences carry a fine, up to ten years' imprisonment or both. In July 2023 the Regulator fined a national government department R5 million for failing to comply with an enforcement notice after a ransomware attack.

Do employers need employee consent under POPIA? Show answer

Usually not. Most employee information is processed because the employment contract or a law requires it, such as payroll tax, UIF and employment equity reporting, and POPIA recognises both as lawful bases. Consent suits genuinely optional uses, such as staff photographs in marketing, and some special personal information, such as biometric clocking where no other authorisation applies.

How long must employers keep employee records? Show answer

Employers must keep records of time worked and remuneration for three years under the Basic Conditions of Employment Act, and tax records generally for five years from submission under the Tax Administration Act. POPIA then requires deletion once no purpose or law justifies keeping them, so set a retention period for every type of HR record.

Know where your personal information stands

Start with a POPIA and security assessment: where personal information lives, how well it is protected and what to fix first, in a report your Information Officer and board can act on. Call 010 447 2445 or talk to us.

Request a security assessment