POPIA compliance pack

Who actually needs this

Be honest with yourself about which of these you are. It changes whether you should buy anything at all.

• A customer or a tender has asked for it. This is the reason nearly everyone buys. A corporate will not release payment or keep you on the panel without a signed operator agreement and a privacy policy, and tender evaluators ask for the PAIA manual by name.
• You hold sensitive information. Medical practices, schools and creches, recruitment and payroll, debt collection, security companies, anyone running direct marketing. The consequences of getting it wrong are real and the questions get asked sooner.
• You have had a breach or a complaint. Someone has demanded their data, or asked you to delete it, or something has leaked. You need a procedure and a record, quickly.
• Nobody has asked you anything. Then you are not urgent, and the POPIA Starter Pack at R890 is probably all you need for now.

What is included

Eleven documents, each customised from your answers about how your business actually handles personal information, plus one registration.

• Privacy policy for your website and your customers, in plain English
• PAIA manual, the document every private body is expected to hold and the one tenders ask for by name
• Operator agreement for suppliers who process personal information for you, and the version to sign when a customer sends you theirs
• Record of processing activities, what you hold, why you hold it, who you share it with and where it goes. This is the backbone document an audit starts from
• Data subject request procedure and forms, for when someone demands a copy of their information or asks you to delete it
• Retention and deletion schedule, how long you keep each type of record and what happens at the end. The one almost nobody has
• Employee privacy notice, because your staff files are personal information too and most small employers never think of it
• Supplier and operator register, the list of everyone who touches your data on your behalf
• Consent and direct marketing wording for your forms, your mailers and your website
• Data breach response procedure with the Regulator notification steps and timelines
• Staff awareness material, a short briefing you can actually put in front of your people
• Your Information Officer registered with the Information Regulator, prepared and submitted for you

What POPIA enforcement actually looks like

We would rather you bought this for the right reason, so here is the honest picture rather than the scare story.

Fines under POPIA have gone almost entirely to large organisations and public bodies, and only after they ignored an enforcement notice first. The Department of Justice and the Department of Basic Education were each fined R5 million. Blouberg Municipality was fined R500 000. Infringement notices of R100 000 went to Lancet Laboratories and FT Rams Consulting. In August 2026 the Regulator issued fresh enforcement notices against public and private bodies, including the SABS after a ransomware attack.

No small South African business has been fined simply for not holding a PAIA manual. The realistic risk for a business your size is not a fine. It is losing a contract, failing a tender, or having a corporate customer hold your payment until you produce the paperwork.

That is the reason to buy this, and it is a good enough reason on its own.

How ordering works

1. Order online with the button below and pay securely by card or instant EFT (PayFast), or wait for the EFT invoice.
2. Complete the questionnaire in your client portal. It asks what information you collect, who you share it with, where it is stored and who handles it. No calls, no meetings, everything in writing.
3. We prepare all eleven documents around your answers and submit your Information Officer registration to the Regulator.
4. Everything lands in your portal downloads within 3 business days, with a short note on what to do with each document.

Not sure whether you need this one or the R890 Starter? Ask us first and you get a written answer within one business day. Tell us what your customer actually asked for and we will tell you which one covers it.

What we will need from you

• What personal information you collect, from customers, staff and suppliers
• Where it is stored, which systems, which cloud services, and whether anything sits outside South Africa
• Who you share it with, including your accountant, your payroll provider and anyone doing marketing for you
• Who handles it internally, and who the head of the business is, since that person is your Information Officer by law
• Your company or close corporation registration number, or identity number if you trade in your own name
• Anything a customer has already sent you to sign, so we work with their wording rather than against it

Frequently asked questions