What are the eight conditions?
Section 4(1) lists them. Each condition below links to its deep guide where one exists — together they are the actual work plan for POPIA compliance:
01Accountability
s 8The buck stops with you, the responsible party — including for work your operators do.
02Processing limitation
ss 9–12Process lawfully and reasonably; collect only what the purpose requires; have a section 11 ground; collect directly from the data subject unless an exception applies.
Minimality & collection →03Purpose specification
ss 13–14Collect for a specific, explicitly defined, lawful purpose — and don’t keep records forever.
Purpose & retention →04Further processing limitation
s 15New uses of existing information must be compatible with the purpose of collection — with a list of deemed-compatible uses.
Sharing & further processing →05Information quality
s 16Take reasonably practicable steps to keep information complete, accurate, not misleading and updated.
06Openness
ss 17–18Keep the PAIA documentation and tell people what you collect, who you are, why, and their rights — in practice, a decent privacy notice.
Privacy notices →07Security safeguards
ss 19–22Appropriate, reasonable technical and organisational measures; operator contracts; breach notification. Where most real enforcement has happened.
Security safeguards →08Data subject participation
ss 23–25People may ask what you hold, request the record, and request correction or deletion.
Data subject rights →
Accountability: the buck stops with you
Condition 1 frames all the others. You, the responsible party:
“must ensure that the conditions set out in this Chapter... are complied with at the time of the determination of the purpose and means of the processing and during the processing itself.”
“During the processing itself” includes the processing your operators do for you — the Dis-Chem enforcement notice turned on a provider’s breach and the missing operator contract, not on anything Dis-Chem’s own systems did.
Compliance is not a stack of consent forms
Notice what the eight conditions do not say: nothing about collecting consent for ordinary business processing. The compliance work POPIA actually demands is structural — know your processing, justify each purpose with a ground, minimise what you collect, set retention rules, publish a privacy notice, secure the data, contract your operators, prepare for breaches, and honour data subject requests. The step-by-step version is the practical compliance shortlist.