The ten steps
01Map your processing
The eight conditions →What personal information, from whom, for what purpose, shared with whom, stored where, kept how long.
02Assign a section 11 ground to each purpose
The six lawful grounds →Use contract, legal obligation and legitimate interest where they genuinely apply; reserve consent for what is truly optional (and record it properly).
03Publish a proper privacy notice
Privacy notices →Covering the section 18(1) items, including categories of recipients and any cross-border transfers.
04Put written contracts in place with every operator
Operators →Section 21 contracts covering security and immediate breach reporting — payroll, IT, cloud, marketing platforms, collections.
05Do the security basics and keep doing them
Security safeguards →Patch, license, monitor, restrict access, verify regularly (s 19). Run a personal information impact assessment (reg 4).
06Prepare a breach plan
Data breaches →Who decides, who notifies, eServices portal credentials ready, draft data-subject notice on file. Notify as soon as reasonably possible — don’t wait for the forensic report.
07Register your information officer
Information officers →Before they take up duties (s 55(2)) — and every group subsidiary registers its own. Appoint deputies in writing where needed.
08Sort your marketing
Direct marketing →Segment customers (s 69(3)) from prospects (s 69(2)); honour every opt-out; keep the objection and withheld-consent registers; record telephonic consents.
09Set retention rules
Purpose & retention →Per record type, with the section 14(1) exceptions in mind — and actually delete or de-identify when they expire.
10Check the narrow special cases
Special personal information →Special personal information (ss 26–33), children (ss 34–35), prior-authorisation triggers (s 57), and special/children’s data going to non-adequate countries (s 57(1)(d)).
If the myths had you doing the wrong work
Notice what the list does not contain: re-consenting your customer base, refusing references, banning CCTV, repatriating your cloud, or buying a “POPIA certificate”. The myths generate busy-work; the Act asks for structure. It requires knowing why you process what you process, being able to say so, and keeping it safe. For a self-assessment against these steps, the firm’s free POPIA compliance audit checklist walks each item with yes/no questions — and where the answers raise harder questions, that is what we do.