What has prompted this?
POPIA Compliance South Africa is the work of knowing what personal information you hold, why you hold it, who can reach it and what you would do if it leaked. Describe your organisation and compare assessment prices and ongoing support. This is general information and not legal advice.
Describe your organisation and get compliance quotes. Every reply comes from a LEADERR APPROVED provider.
Get the Best QuoteWhat the Work Usually Covers
- A data inventory. What personal information you hold, where it is and why.
- A gap assessment. What the Act requires against what you actually do.
- Policies. Privacy notice, retention, access requests and acceptable use.
- An Information Officer. Registered with the Regulator, with the duties understood.
- Operator agreements. Written terms with every supplier who processes data for you.
- Security measures. The technical side: access control, encryption, backup and logging.
- Incident procedure. Who does what, and the notification obligations with their deadlines.
- Training. Staff are where most breaches start.
The Parts Most Often Missing
- The records. Compliance you cannot evidence is hard to defend.
- Retention. Keeping everything forever is itself a breach of the principles.
- Supplier contracts. Payroll, cloud services and marketing agencies all process your data.
- Access requests. A process for when someone asks what you hold about them.
- Marketing consent. Direct marketing has its own rules and they are specific.
- Cross-border transfers. Cloud services outside South Africa need to be accounted for.
POPIA Compliance Prices
Ballpark figures so you can check a quotation.
| Item | Ballpark price |
|---|---|
| POPIA gap assessment, small business | R18,000 - R65,000 |
| POPIA gap assessment, mid-size organisation | R65,000 - R250,000 |
| Policy pack and privacy notice | R12,000 - R55,000 |
| Data inventory and records of processing | R25,000 - R120,000 |
| Staff awareness training, per session | R8,500 - R28,000 |
| Information Officer support, per month | R6,500 - R35,000 |
| Incident response procedure and drill | R15,000 - R65,000 |
| Technical security remediation | R25,000 - R350,000 |
Prices JUST UPDATED. Ballpark figures, rounded, excluding VAT. They reflect typical South African IT support and technology rates. They are not our prices or quotations, and no provider is bound by them. Confirm what each quotation includes, such as how many users or devices are covered, the response times, after-hours cover and licence fees.
Get a scoped price for your own organisation rather than a range.
Get the Best QuoteWhat Affects the Price
- How much personal information you hold. A clinic and a workshop are not the same exercise.
- How many systems it sits in. Each one has to be examined.
- Your sector. Health, financial and education data carry extra obligations.
- How many staff. Training and access control scale with headcount.
- Your starting point. Nothing written down costs more than policies that need updating.
- Whether remediation is included. Finding the gaps and closing them are separate pieces of work.
- Whether you need ongoing support. Compliance is a standing obligation, not a project.
What to Include in Your Request
- What your organisation does. And whose personal information you handle.
- How many staff and customers. Roughly, for scale.
- What systems hold the data. Including spreadsheets and paper files.
- What you have already. Policies, an appointed Information Officer, any prior assessment.
- What prompted this. A client requirement, a complaint, an incident or a tender.
- Your deadline. A tender date often sets it.
Before the Provider Quotes
- Ask whether legal input is included. Much of POPIA is operational, and some of it is not.
- Ask what you receive. A register, policies and a prioritised plan you can act on.
- Separate assessment from remediation. Quote them apart so the findings stay honest.
- Ask about ongoing support. The obligations continue after the report.
- Make sure the technical side is covered. Policies without access control and backup are paperwork.
- Ask about training. The cheapest risk reduction available.
POPIA Compliance FAQs
Who does POPIA apply to?
Broadly, any organisation in South Africa that processes personal information, which in practice is almost all of them - staff records alone qualify. The scale of the obligation varies enormously with what you hold and about whom, but the exemption most small businesses hope for does not exist. This is general information, not legal advice.
What is the first thing to do?
Find out what personal information you actually hold, where it lives and why. Nearly everything else in the Act follows from that inventory, and most organisations are surprised by how much turns up in old spreadsheets, shared drives and inboxes.
Do we need to register an Information Officer?
The head of the organisation is the Information Officer by default, and registration with the Information Regulator is expected. The duties can be delegated to a deputy, but the responsibility does not move. Check the Regulator's current registration process, as the mechanism has changed since the Act commenced.
What happens if there is a data breach?
The Act requires notification to the Information Regulator, and to the affected people where their information was compromised, as soon as reasonably possible after discovery. That is very hard to do well without a procedure written in advance, which is why the incident plan is worth more than most of the policy pack.
Does using overseas cloud services breach POPIA?
No, but it has to be accounted for. Transfers outside South Africa are permitted where there is adequate protection, usually through the provider's contractual terms. The requirement is to know which services hold personal information, where, and on what terms - not to keep everything local.
Is this an IT project or a legal one?
Both, and the split is roughly even. The inventory, access control, encryption, backup and logging are IT work. The policies, contracts, consent and the Information Officer's duties are legal and operational. A provider who offers only one half should say so.
Compliance work is offered by several of the providers on IT Support South Africa usually together with the security measures the Act expects.
Related Services
Get the Best Quote, Fast
Client Reviews
Powered by leaderr
