POPIA compliance: the framework, the safeguards and the evidence
POPIA compliance means processing personal information lawfully under the Protection of Personal Information Act, and being able to prove it. Arke Technologies, in Johannesburg, helps organisations, public bodies and schools across South Africa build the compliance framework, secure the systems that hold personal information and keep the evidence the Information Regulator expects.
What POPIA compliance means
The meaning of POPIA compliance is simple to state and demanding to deliver: every record you hold about a person, whether customer, learner, patient, citizen, supplier or employee, is collected for a defined purpose, kept no longer than necessary, protected by reasonable safeguards and open to the person it describes. The POPI Act (the Protection of Personal Information Act 4 of 2013) sets eight conditions for lawful processing, which the Information Regulator enforces alongside the Promotion of Access to Information Act (PAIA).
Being POPI Act compliant is a state you maintain, not a certificate you frame: a framework that governs the work, systems that protect the information and records that prove both.
Full compliance with the requirements of POPIA was required by 30 June 2021, when the one-year grace period after most of the Act took effect on 1 July 2020 ended, so there is no later POPIA compliance date or deadline to wait for. POPIA compliance sits within our cybersecurity services, because section 19, the security condition, is met largely in your systems.
Your POPIA compliance framework
Regulation 4 of the POPIA regulations requires the Information Officer to ensure that a compliance framework is developed, implemented, monitored and maintained. A POPIA compliance framework template or toolkit gives you headings; the content must describe your own organisation. The framework we help you build contains:
A data inventory: what personal information you hold, where it lives (mailboxes, file shares, HR, payroll, finance, cloud applications, backups and paper) and who can see it.- A personal information impact assessment, also required by regulation 4.
- A register of purposes, each with its lawful basis and retention period.
- Notices and manuals: a privacy notice for each audience, the PAIA manual (PAIA sections 14 and 51) and the internal rulebook many organisations call a POPIA compliance manual.
- A safeguards baseline mapped to section 19, and operator agreements with every supplier that processes personal information for you.
- A security compromise plan for section 22 notifications, and a process for access, correction and deletion requests.
- Training records for POPIA compliance training and the awareness sessions regulation 4 requires.
Together these form a data protection management system: registers, controls and reviews that make data protection management a monthly routine, not a one-off project. Our POPIA compliance checklist lists the evidence to keep for each item.
Security safeguards: where data protection meets cyber security
Data protection and cyber security meet in section 19. It requires appropriate, reasonable technical and organisational measures against the loss of, damage to or unauthorised destruction of personal information, and against unlawful access to it, with due regard to generally accepted information security practices. It also prescribes a method: identify the risks, establish safeguards, verify regularly that they work and update them as risks change.
Cyber data protection therefore starts with the controls attackers test first: multi-factor authentication and separate administrator accounts (Microsoft 365 security); protection against phishing and changed banking details (email security); patched, encrypted and managed devices; and backups that ransomware cannot reach (ransomware protection). "Verify regularly" is the step most often skipped, as licences lapse and exceptions become permanent, so we test the safeguards with a cybersecurity assessment and, where you need proof, a penetration test.
Privacy by design: software, AI and Microsoft 365
GDPR Article 25 asks for data protection by design and by default, which is what GDPR for software developers means in practice, and POPIA leads to the same place: collect less, restrict access, encrypt, log and delete on schedule. Our custom software development team designs to those rules from the first specification.
- AI tools. An AI privacy policy generator can draft a notice in minutes, but it cannot know what you collect or where you store it, and a notice that misdescribes your processing breaches the openness condition, so check every line against your data inventory. When we build AI into your systems, data is minimised, encrypted and access-logged, and never used to train models without explicit consent; see AI governance.
- Microsoft 365 and Google Workspace. Microsoft POPIA compliance questions come up in every tenant review. Microsoft's data protection terms set out its duties as the provider, your operator under POPIA; your tenant's configuration remains yours. Sensitivity labels, data loss prevention, retention and Compliance Manager in Microsoft Purview are POPIA compliance software many organisations already license but have not switched on, and Google Workspace has data protection rules, Vault and sharing controls.
Governance, procurement and continuity
- Reporting. A POPIA section in your monthly service review (requests, incidents by priority, safeguards tested, operator agreements, open risks) and an annual summary for the board, council or governing body.
- Public sector and schools. Public bodies hold citizens' information under PFMA or MFMA disciplines and PAIA; schools hold children's personal information, which POPIA protects more strictly (sections 34 and 35). See government cybersecurity and POPIA for schools.
- Our own duties. When we manage your systems we process personal information for you: every remote session is approved and logged, and everyone with access is bound by confidentiality and our security controls. See our privacy notice and PAIA manual.
- Procurement. Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor (sworn affidavit available on request). Company documents, our CSD supplier number and SARS tax compliance status are available on request, and we complete SBD forms when a bid requires them; see company facts. Buy the assessment on a proposal and purchase order, or through your tender process.
- Continuity. The inventory, registers, policies and evidence are yours, in editable formats, and you own your data, credentials and documentation. If your Information Officer changes, or you change provider, the framework hands over intact.
What POPIA compliance costs
Last reviewed: September 2026.
POPIA compliance costs fall into three lines: legal work on notices, policies and contracts; systems and security work; and your own people's time. The systems line depends on how many systems and sites hold personal information, how sensitive it is (health, children's and financial information raise the bar), how many operators you use, and how much of the protection you already license is switched on.
We quote the assessment and remediation per project, and ongoing managed security per user per month after the assessment. For context, published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026).
