DIY POPIA solution for small to medium enterprises

The aforementioned “practicable steps” usually takes the form of a privacy notice, which can be published by your business on its website, or the notice can be sent to the data subject whenever the business will be processing that data subject’s personal information.

The Privacy Notice is drafted from a financial services provider’s perspective and will be a valuable template to guide you through the numerous requirements stipulated in section 18.

In light of this daunting prospect, we have simplified the POPI Act for you by developing a POPIA Activity Checklist which contains 32 structured activities that are fundamental to establishing a POPIA compliance framework within your business.

The Activity Checklist also provides valuable guidance on the application of each activity and gives further context to the activity within the POPIA compliance framework. This checklist is therefore not a “tick box” template, but rather provides valuable insight into how your business can go about managing its POPIA compliance project on a “Do It Yourself” basis.

The POPI Policy includes the legislative requirements in the POPI Act, the Regulations to the POPI Act, as well as the recently issued Guidance Note on Information Officers and Deputy Information Officers.

This template also includes additional customisable annexures such as a Personal Information Request Form; POPI Complaint Form; generic POPIA Privacy Notice; Employee Consent and Confidentiality Clause; SLA Confidentiality Clause and a (Deputy) Information Officer Appointment Letter.

To get a bird’s eye view of these risks, we have mapped out the 104 POPIA risks on a customisable regulatory risk register. This means that you can either add or delete risks that do not apply to your business.

The register also provides for likelihood and impact ratings, a final risk rating (with different colours to generate a risk “heatmap”), a description of control measures and suggested compliance risk areas.