South Africa POPIA

Protection of Personal Information Act - eight conditions for lawful processing, IR, accountability.


Short name	POPIA
Region	Middle East & Africa
Country or scope	South Africa
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers POPIA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for POPIA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for POPIA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ZA-POPIA-19` Security Safeguards	Responsible parties must secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organizational measures; integrity hashes over the software inventory evidence such safeguards (POPIA s. 19)	Scan
`ZA-POPIA-21` Operator Security	Processing by an operator must be governed by a written contract obliging the operator to maintain the security safeguards, which requires knowing the suppliers behind the software in the processing chain (POPIA s. 21)	Scan
`ZA-POPIA-22` Breach Notification Readiness	Security compromises must be notified to the Information Regulator and affected data subjects as soon as reasonably possible; assessing a compromise quickly requires known versions across the software estate (POPIA s. 22)	Scan
`ZA-POPIA-17` Documentation of Processing Operations	Responsible parties must maintain documentation of all processing operations under their responsibility; an identified, timestamped SBOM of the processing systems contributes directly to that documentation (POPIA s. 17)	Scan
`ZA-POPIA-16` Information Quality	Reasonable steps must be taken to ensure personal information is complete, accurate and updated; the parallel discipline for the processing environment requires components carrying both name and version (POPIA s. 16)	Scan
`ZA-POPIA-IO` Information Officer Accountability	An information officer must encourage and ensure compliance with the conditions for lawful processing, providing a reachable accountability contact for the systems described in the SBOM (POPIA, information-officer duties)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`POPIA-S8`	Accountability (Section 8)
`POPIA-S9`	Processing Limitation (Section 9)
`POPIA-S13`	Purpose Specification (Section 13)
`POPIA-S19`	Security Safeguards (Section 19)
`POPIA-S22`	Notification of Security Compromise (Section 22)
`POPIA-S23`	Data Subject Rights: Access and Correction (Sections 23-25)
`POPIA-XBORDER-1`	Cross-Border Transfer Conditions
`POPIA-IO-1`	Information Officer Registration and Duties

Policy templates

Written for POPIA:

POPIA: Privacy Notice (PAIA Section 51 / POPIA)
POPIA: Security Compromise Notification Procedure (Section 22)
POPIA: Data Subject Rights Procedure (Sections 23-25)

And 22 from the standard set, adapted to POPIA.