POPI Act Compliance Checklist

Organisation Name *

Please advise of the industry that your organisation is in *

How many employees does your organisation have? *

Please insert this as a numerical number rather than as words.

Do you have a website? *

Do you collect personal information of the users on your website? *

Even if you only have a contact form on your website, you will be collecting personal information.

Personal Information is essentially any piece of information which could identify a person or entity, and may include, but is not limited to, some of the below:
First name
Surname
Email
Race
Age
Sex
Company name
Company registration number
Phone number
Email address
Physical address
Sexual orientation
Pregnancy
Physical or mental health
Marital status
National, ethnic or social origin
Religion
Conscience
Culture
Language
Disability
Information relating to education
Medical history
Criminal history
Financial history
Employment history

Do you have a Privacy Policy on your website? *

Are you confident that your Privacy Policy is in compliance with the POPI Act? *

Do you engage with other parties (such as suppliers) which you share the personal information of your customers or other persons with? *

Personal Information is essentially any piece of information which could identify a person or entity, and may include, but is not limited to, some of the below:
First name
Surname
Email
Race
Age
Sex
Company name
Company registration number
Phone number
Email address
Physical address
Sexual orientation
Pregnancy
Physical or mental health
Marital status
National, ethnic or social origin
Religion
Conscience
Culture
Language
Disability
Information relating to education
Medical history
Criminal history
Financial history
Employment history

Do you have an agreement in place that you enter into with such suppliers or parties which you share this personal information with which specifically sets out what personal information is being shared with them, and how it may be used (this is known as an Operator Agreement in terms of the POPI Act)? *

This type of agreement is known as an Operator Agreement. It is not simply any agreement that you enter into with a supplier, but a specific agreement between you and a supplier setting out how the supply may store, share and/or use the personal information of your clients etc that you provide to the supplier.

Are you confident that this Operator Agreement is in compliance with the POPI Act? *

When you engage with suppliers, you will no doubt collect personal information from them, such as a name or email address. In order to do so, do you have Data Protection Policy that such suppliers agree to? *

Data Protection Policy aims to achieve the same thing, consent from a supplier as to how you may store, share and/or use the personal information of such supplier.

Are you confident that this Data Protection Policy is in compliance with the POPI Act? *

When you engage with clients, you will no doubt collect personal information from them, such as a name or email address. In order to do so, do you have a Data Protection Policy that such clients agree to? *

A Data Protection Policy are different names for essentially the same documents.

They all aim to achieve the same thing in this context, consent from a client as to how you may store, share and/or use the personal information of such client.

Are you confident that this Data Protection Policy is in compliance with the POPI Act? *

Do you have any employees? *

Do your employees have provisions in their employment agreements which specifically cater for personal information being collected from them and how it is used? *

Do you have any internal workplace policies which your staff have to agree to around how they can treat the personal information of the clients and suppliers that your staff come into contact with? *

Do you have a written Data Breach Policy in place? *

Do you have a PAIA Manual (Promotion of Access to Information Manual) in place? *

A PAIA Manual (not to be confused with a POPI Manual) is a document which sets out how, when and in what instances third parties are able to obtain access to a record held by your organisation.

Have you registered an Information Officer with the Information Regulator for your organisation? *

Do you engage in direct marketing? *

Direct marketing is a form of advertising that reaches customers directly through various channels, such as mail, email, or telemarketing.

Who do you direct market to? *

Existing Customers
Prospective Customers

Do you ensure that you obtain the consent of a prospective customer before direct marketing to them? *

Your Name *

First

Last

Email *

I agree to our Privacy Policy

POPI Act Compliance Checklist Questionnaire

Complete the questionnaire below (Around 3 mins to complete)

We'll send your POPI Act Compliance Checklist Report directly to your inbox straight away.