Practical guide · South Africa
POPIA basics: a practical guide for South African small businesses
POPIA is South Africa’s law for protecting personal information. This guide turns the Act’s main processing conditions into a practical starting checklist for a small business.
Published 23 October 2026 · Educational information, not legal advice
Start with your own process
A useful first step is to map what information one team handles and why.
Take the free assessmentWhat is POPIA?
The Protection of Personal Information Act 4 of 2013 (POPIA) regulates the processing of personal information by public and private bodies in South Africa. The Act sets conditions for lawful processing and gives people rights relating to their personal information. Whether and how a particular duty applies depends on the organisation and the processing involved.
Read the official Act text and the Information Regulator’s POPIA guidance for authoritative detail.
The eight conditions in plain language
Section 4 of POPIA names eight conditions for lawful processing. Use this as a memory aid; it is not a substitute for the Act or advice about your circumstances.
Condition 1
Accountability
Assign responsibility for how personal information is handled.
Condition 2
Processing limitation
Collect and use information with appropriate limits.
Condition 3
Purpose specification
Be clear about why information is collected and used.
Condition 4
Further processing limitation
Check that later uses fit the original purpose and applicable rules.
Condition 5
Information quality
Take reasonable steps to keep information accurate and current.
Condition 6
Openness
Be transparent about your information-handling practices.
Condition 7
Security safeguards
Protect information with appropriate technical and organisational safeguards.
Condition 8
Data subject participation
Provide ways to exercise rights relating to personal information.
Five practical first steps
Start with one real process. Small, documented improvements are easier to review and maintain than a folder of policies nobody uses.
- 1
Map one business process
Pick a real process, such as handling a customer enquiry or onboarding a staff member. List the information collected, why it is used, where it is stored, and who can access it.
- 2
Name a responsible person
Make it clear who staff should ask about information-handling questions and who coordinates requests or incidents.
- 3
Review vendors and tools
List service providers and cloud tools that may handle personal information for your business. Note what they handle and where to find the written terms and security details.
- 4
Check everyday safeguards
Review access to one system, the way staff share records, and what people should do if information may have been exposed.
- 5
Set a review date
Choose when to revisit this process and record what changed. Your practices should keep up with changes in your business and the tools you use.
Official South African resources
- Protection of Personal Information Act 4 of 2013 — the Act text hosted by the Department of Justice.
- Information Regulator POPIA resources — guidance notes and regulator information.
- Information Regulator PAIA manuals — official portal for PAIA manual information and templates.
When to get tailored advice
This guide and ComplyMate’s assessment are educational tools. They do not certify compliance or replace advice from a qualified professional. Get tailored advice when your business handles sensitive or high-risk information, has complex vendor or cross-border arrangements, or is responding to an incident.