POPIA and your business systems:
a practical checklist

Start with where the data actually is

The Protection of Personal Information Act applies to every business in South Africa that holds information about people — customers, staff, suppliers, applicants. Most businesses believe their personal information lives in one or two systems. When we map it, it is usually in six: the accounting package, the CRM, a shared spreadsheet, the payroll system, the WhatsApp group the drivers use, and an export someone emailed to themselves in 2022.

The first practical step is a plain inventory. For each system: what personal information does it hold, why, who can see it, and how long is it kept? You cannot secure what you have not found, and you cannot answer a data-subject request about data you do not know you hold.

Access control is the whole game

POPIA’s security safeguard condition comes down to one question an auditor will ask: who can see this, and why? A shared login, a spreadsheet on a shared drive, or an admin account everybody uses all fail that question in the same way.

In a well-built system, access is by role, not by person, and every change to a customer record is logged with who made it and when. That is not an expensive feature; it is a design decision made at the start. Retrofitting it onto a system that was never built for it is where the cost comes from.

The checklist

Keep this short and keep it honest:

1. An inventory of every system that holds personal information, with an owner for each.
2. A purpose for each category of data — if you cannot say why you hold it, delete it.
3. Role-based access, with no shared logins, and an audit trail on customer records.
4. A retention rule that the system enforces, not one a person has to remember.
5. A tested way to find, export and delete one person’s data on request, within the Act’s timeframes.
6. Backups that are encrypted and in a known location — a South African Azure region, for most of our clients.
7. Operator agreements with every third party that processes data on your behalf.
8. A named Information Officer, registered with the Regulator, who actually knows the answers to 1–7.

Where systems help, and where they do not

A system cannot make a business compliant. It can make the compliant thing the easy thing: capture a customer once, with a purpose, under a role, with a retention date, and the inventory, the access control and the deletion rule all take care of themselves. That is the difference between compliance as a yearly panic and compliance as a property of how the business runs.

If your customer data is spread across spreadsheets and exports, a consolidation project is usually the fastest route to both a better business and a defensible POPIA position — and the two pay for each other.