A Plain-English POPIA Compliance Checklist for SMEs

The Protection of Personal Information Act (POPIA) has been fully enforceable for a few years now, yet many South African SMEs still treat it as a big-company problem. It isn’t. If you hold names, emails, ID numbers, or any personal information about customers or staff — and every business does — POPIA applies to you. The good news: for a typical SME, compliance is mostly common-sense data hygiene. Here’s a practical checklist. This is general guidance, not legal advice — verify your specific obligations with a legal professional.

1. Know what personal information you hold

You can’t protect or account for data you haven’t mapped. List what you collect (customers, staff, suppliers), where it’s stored (email, CRM, spreadsheets, cloud, paper), and who can access it. This “data inventory” is the foundation of everything else.

2. Appoint an Information Officer

By default this is your head of the business (CEO/owner), and POPIA requires them to be registered with the Information Regulator. You can delegate day-to-day tasks to a Deputy Information Officer. Verify the current registration process at the Information Regulator’s site.

3. Have a clear reason for every piece of data

POPIA requires you to collect personal information for a specific, lawful purpose and not keep it “just in case.” Review your forms: are you asking for data you don’t actually need? Minimise.

4. Get and record consent (where required)

For marketing especially, you generally need consent, and people must be able to opt out easily. Make sure your newsletter and contact forms explain what you’ll do with the data and link to your privacy policy.

5. Publish a POPIA-compliant privacy notice

Tell people what you collect, why, who you share it with, and their rights (access, correction, deletion, objection). A visible privacy policy page is the baseline — most SMEs already need to update theirs.

6. Secure the data

POPIA requires “reasonable” technical and organisational safeguards. Practically: MFA on email and key systems, endpoint protection, encrypted backups, access limited to who genuinely needs it, and prompt removal of ex-staff access. Most of these are ordinary good IT security — which is why a POPIA gap is usually also a security gap.

7. Manage third parties (operators)

If a supplier processes personal information for you (your cloud provider, payroll bureau, email platform), POPIA expects a written agreement holding them to the same standards. List your operators and check you have the paperwork.

8. Plan for data subject requests and breaches

People can ask what you hold about them and request corrections or deletion — you need a way to handle that. And if a breach exposes personal information, you must notify the Information Regulator and affected people as soon as reasonably possible. Decide now who does what if it happens.

9. Train your team

The weakest link is usually a person clicking a phishing link or emailing a spreadsheet to the wrong address. Short, regular awareness training closes more real-world POPIA risk than any single tool.

10. Review annually

Data, systems and staff change. Revisit this checklist at least once a year, and whenever you adopt a major new system.

Where SMEs most often fall short

No data inventory, no test-restored backups, ex-employees still holding access, and a privacy policy that doesn’t match what they actually do. Fix those four and you’ve closed most of the common gaps.

POPIA compliance and IT security are the same job done well. African Vanilla helps Johannesburg and Gauteng businesses close both. Request a free security & compliance assessment.

Start with our free IT audit checklist, or explore our cybersecurity and POPIA compliance service.