Managing POPIA obligations with Riskophia
Protection of Personal Information Act (South Africa)
What it is
South Africa's data protection law, enforced by the Information Regulator. It sets eight conditions for lawful processing of personal information and requires organizations to appoint an information officer.
Who it applies to
Public and private bodies that process personal information in South Africa, and organizations outside South Africa that use means in the country to process it.
Representative obligations
- Eight conditions for lawful processing
- Information officer registration and duties
- Processing limitation and purpose specification
- Security safeguards and operator agreements
- Data subject participation
- Security compromise notification
- Prior authorization for certain processing
This list is illustrative and is not legal advice. Your obligations depend on your activities, jurisdictions and the current text of the law.
From POPIA text to evidence on file.
Riskophia helps you manage the compliance activities associated with POPIA. It does not by itself make you compliant or approved; that depends on your practices and on the relevant regulator.
Requirements register
POPIA obligations broken into plain-language requirements with owners, cadence and status.
Policies and attestations
Policy templates aligned to POPIA, version controlled and acknowledged by the right roles.
Training records
Mandatory training assigned by role through Learnophia, with completion recorded as evidence.
Evidence and gaps
Evidence linked to each requirement; gaps become owned actions with verified closure.
Crosswalk
Where POPIA overlaps other regulations and standards, one control and one piece of evidence serve all of them.
Export
An inspection-ready package of status, evidence and history for POPIA.
See your POPIA obligations in Riskophia.
Book a 30-minute demo led by a compliance professional, or talk to an expert about your sector.