Privacy
Data protection & POPIA, made workable.
If your business collects names, emails, ID numbers or any other personal information, the Protection of Personal Information Act applies to you. We help you comply in a way that fits how you actually work.
What POPIA means for your business
It applies to almost everyone
If you process personal information about customers, staff or suppliers in South Africa, you must meet POPIA’s conditions for lawful processing. There’s no general exemption for small businesses.
Someone has to be responsible
Every organisation has an Information Officer, by default its head, who must be registered with the Information Regulator and make sure the business complies.
Getting it wrong is costly
The Information Regulator can impose fines of up to R10 million, and some offences carry prison sentences. A breach can also cost you customers’ trust.
How we help
From first assessment to everyday compliance.
It starts with a compliance assessment. You answer our questions in your secure client hub, and an attorney reviews your answers and gives you a report on where you stand, with prioritised recommendations. The assessment is charged at a fixed fee, agreed before you start.
We then provide the policies, help you put the changes in place and appoint the people responsible. Each of them gets their own access to the client hub to track progress.
- Compliance assessment
- Our questions, answered in your client hub, and an attorney-reviewed report with your status and recommendations.
- Privacy policies and notices
- Written for your website, app and staff, in language people can understand.
- PAIA manual
- Prepared and kept up to date, if your business needs one.
- Operator agreements and DPAs
- Contracts with the cloud services and suppliers that handle data for you.
- Information Officer support
- Registration, training and a simple compliance calendar.
- The people responsible
- We help you appoint them, and each gets their own client hub access to track their steps.
- Breach response
- Fast, practical help if personal information is lost, stolen or exposed.
Common questions
How does the compliance assessment work?
You answer our questions about how your business collects, uses, shares and protects personal information, in your secure client hub. An attorney reviews your answers and gives you a report on where you stand, with prioritised recommendations. The assessment is charged at a fixed fee, agreed before you start. We then provide the policies, help you put the changes in place and appoint the people responsible, who can track progress in the hub.
Does POPIA apply to my small business?
Almost certainly. If you collect personal information such as names, contact details or ID numbers from customers, staff or suppliers, POPIA applies. There’s no general exemption based on size.
What is a PAIA manual, and do I need one?
A PAIA manual explains how people can ask for access to records your business holds. Most private bodies need one, though some small businesses are exempt. We’ll tell you whether yours does.
We have customers in Europe. Does GDPR apply too?
It can. GDPR can apply to businesses outside the EU that offer goods or services to people in the EU, or monitor their behaviour. We can help you meet both sets of rules together.
What should we do after a data breach?
POPIA requires you to notify the Information Regulator and the people affected as soon as reasonably possible. Contact us straight away and we’ll help you assess what happened, notify correctly and fix the cause.
Find out where you stand on POPIA.
Start with a compliance assessment: an attorney-reviewed report with prioritised recommendations, at a fixed fee agreed upfront.