3 September 2026LANTEK Computers
Work down this list and mark each item done, partly done or not started. There is no score at the end, deliberately: POPIA sets no threshold you can total up to, and a number would imply otherwise. What you will have is an honest picture and an ordered list of what to fix.
This is not legal advice, and completing it does not make you compliant. It tells you where you stand.
The four that change your position most
1. Multi-factor authentication is on every mailbox. Every one, including directors and including the shared info@ address. If this is not done, do it before anything else on the list. It is the single control that most reduces the chance of the breach you would have to notify. Why it is not optional.
2. Somebody has restored from your backup, recently, and wrote it down. Not that backups run. That a restore happened, was opened, and worked. POPIA covers loss of personal information, not only leakage. How to test one.
3. You know who your Information Officer is, and they know. If nobody was designated it is the head of the business by default. Registration with the Regulator is a separate step, and worth confirming with your attorney rather than assuming. What the role involves.
4. You have written down what personal information you hold and where it lives. Places, not categories. This is the document everything else depends on, and it is the one most businesses do not have. If you do nothing else on this list, do this and item one.
The five about access and control
5. People can only reach what their job requires. Go through the shared drive and the systems. The common finding is that everybody can reach everything because it was set up in a hurry years ago.
6. Leavers’ accounts are closed on the day they leave. Check the current list of accounts against the current payroll. An account belonging to somebody who left is both an exposure and a licence you are paying for.
7. Laptops that leave the building are encrypted and lock themselves. Both parts. An encrypted laptop that never locks is not encrypted in any practical sense.
8. Nobody is using a personal cloud account for work files. Ask, without making it a disciplinary matter, because the answer is usually yes and the reason is usually that the official route was inconvenient. Fix the inconvenience.
9. You know which third parties process personal information for you, and there is an agreement with each. Payroll bureau, accountant, marketing agency, recruitment, anyone with access to your systems. Their breach is still your notification.
The three about process
10. You have decided how long you keep things, and you actually delete. Information held past its purpose is pure liability with no upside. A decision written down, even a rough one, beats keeping everything forever by default.
11. You know what you would do in the first hour of a suspected breach. Who owns the decision, whose numbers you would ring, where the log gets written. The first 24 hours is the sequence, and the notification question is in when you have to notify.
12. Your privacy notice reflects what you actually do. Not a template naming practices you do not follow. A notice that describes something different to your real processing is worse than a short accurate one.
The items people are surprised by
Worth calling out, because they get missed even by businesses that have taken POPIA seriously.
CCTV, biometric readers and the visitor book. All collecting personal information, all in scope. Covered in does POPIA apply to CCTV.
WhatsApp. If quotes, instructions and client details move through it, that is processing, on devices you may not control.
Job applications. Businesses collect CVs and keep them indefinitely. That is personal information with a purpose that expired when the role was filled.
The old server in the corner. Decommissioned but never wiped, still holding everything it held.
Marketing lists. Where the addresses came from, and whether you can show consent, is a POPIA question and it is one of the more likely to generate a complaint.
What to do with the results
You will probably finish with three or four items done, several partly, and a handful not started. That is a normal outcome and it is not a crisis.
Take the not-started items, put them in the order this article uses rather than the order that feels urgent, and give each one a name and a date. Then write one page recording what you found, what you decided to do, and when. That page is the thing that turns an afternoon of checking into evidence of a reasonable approach.
Do not attempt all twelve at once. Items one and two can be done this month and between them they cover the two most likely bad outcomes.
A warning about what you will be sold
There is no POPIA certification. Nobody can certify you compliant, because the Act does not provide for it, and any supplier offering a certificate is selling something that does not exist. Be equally careful with anything described as making you compliant automatically. Compliance is a set of decisions and records; software can support them and cannot replace them.
What a business with no technical staff can reasonably do itself is set out in what POPIA actually requires from a business with no IT department, and how we build the security half in is on Compliant by design.
If you have worked through this and want an outside read on the technical items, the free health check covers them in thirty minutes and you keep the report either way.