Most employers, HR managers, school administrators and SME owners who ask about POPIA documents are really asking one question: if someone looked at our files tomorrow, what should be there? The answer is a short list of eight. A second question is asked far less often, and it matters more: would anyone in the organisation recognise those documents, or follow them, on an ordinary working day?
The second question is the one the law itself points to. The Information Regulator's Guidance Note on Information Officers, which summarises regulation 4 of the POPIA Regulations, says the Information Officer must ensure that a compliance framework is "developed, implemented, monitored and maintained". The word that is easiest to skip is "implemented". A folder of documents shows that someone wrote them. It does not show that anyone uses them.
POPIA documents to have in place, and one test for each
The list below is a working checklist, not a statutory list. Some items are required by the Act or by PAIA by name, and others are how an organisation shows that its duties are being carried out. Each item comes with a test that can be answered in a few minutes.
- Information Officer designation record. Records who holds the role and that the person was formally designated, so that the registration with the Information Regulator reflects the real position. Test: can staff name the Information Officer?
- Data protection policy. Explains how the organisation handles personal information and who is responsible. Test: can a manager find it and say what it asks of them?
- Privacy notice. Tells people what is collected, why, and who receives it. Test: does it describe what happens today, rather than what a template assumed?
- PAIA Section 51 manual. Describes how someone can request access to the organisation's records, and what categories are held. Test: is it current, and could a requester find it?
- Operator agreements. Section 21(1) of POPIA requires a written contract under which the operator, such as a payroll or IT provider, establishes and maintains the security measures in section 19. Test: can the organisation list every provider that touches its people's or clients' information?
- Data subject rights procedure. Sets out how requests to access, correct or delete information are received, logged and answered. Test: if a request arrived today, who would receive it?
- Security compromise response procedure. Sets out who does what when information is lost or accessed without authority. Decisions about notification belong with qualified legal counsel. Test: does everyone know who to tell, and how quickly?
- Compliance register. The working record of what is processed, how long it is kept, what was destroyed, and which requests and incidents were handled. Test: when was it last updated, and by whom?
Where the documents and daily practice drift apart
Two of these tests tend to expose the same gap. The privacy notice and the operator list are both written once, and then the organisation changes: a department adds a survey tool, a school adopts a messaging app, a new payroll provider arrives. The documents stay put while practice moves. The post on personal information stored outside South Africa follows the same pattern from the Section 72 side, and the PAIA Section 51 manual needs the same upkeep, because a manual that no longer matches the records held is hard to rely on.
How documents are tested against practice
The working method at Kevin Bishop Consulting treats this as an operationalisation question rather than a documentation one. For each document, what the paper says is tested against what people actually do, through short conversations with the people who handle the information and, where possible, a look at the workplace itself. Each finding is scored before it is discussed, so the conversation starts from a ranked list of remediable starting points rather than a verdict. It is the evidence-against-requirement discipline of an ISO 9001-style audit, applied to personal information, and it suits a Johannesburg school or a ten-person firm in Gauteng as well as a larger employer.
One action for this week
One action is enough for this week. Pick the document from the list above that matters most to your organisation, then ask three people who are not in management what it says, or where it is kept. Their answers show how far the document has travelled. For organisations that want a starting point on where they stand across both Acts, the POPIA/PAIA Readiness Snapshot is a desktop, self-reported readiness rating. The same test applies to this site's own Privacy Policy: a published notice is only as good as its match with practice.
Related reading: