A POPIA privacy notice is often the first document an organisation publishes, and frequently the one copied from somewhere else. A polished template or another organisation's website solves the Friday deadline. The harder question comes afterwards: is the finished notice true? Does it describe what this organisation really collects, why, and who else receives it?
Employers, HR managers, school administrators and SME owners rarely call this a privacy-notice problem. It tends to arrive as a plain question: "There is a privacy statement on our website, so are we covered?" or "A parent asked who sees the photos." The notice is only half of the answer. The other half is what people in the organisation do on an ordinary day.
What a POPIA privacy notice has to say, and how to check it against practice
Section 18(1) of POPIA asks the responsible party to take reasonably practicable steps to make the person aware of a defined set of things. In short, these are:
- the information being collected, and its source where it does not come from the person;
- the name and address of the organisation collecting it, and the purpose;
- whether supplying the information is voluntary or mandatory, and what follows if it is not supplied;
- any law that authorises or requires the collection;
- any intended transfer to another country, and the level of protection there;
- further information such as the recipients, and the person's rights of access, correction, objection and complaint to the Information Regulator.
Under Section 18(2), when the information is collected directly from the person, this comes before collection, unless the person already knows it. A template cannot supply most of these items. It has no way of knowing which systems a particular school, shop or office uses, so the wording is generic and the details are guessed.
Where a copied notice and daily practice drift apart
The mismatch is rarely deliberate. As a hypothetical illustration, a notice might say that information is never shared with third parties, while payroll sits with an outside provider and the files are backed up to a cloud service. Or a school notice might describe learner records but not the attendance app, or the cameras at the gate. Nobody intended the notice to be wrong. It was simply never compared with practice.
How a privacy notice is tested against practice
The working method at Kevin Bishop Consulting treats a privacy notice as a set of claims to be tested rather than a document to be tidied. Each statement is set against what people actually do, through short conversations with reception, HR and finance and, where possible, a look at the forms, sign-in sheets and systems themselves. Each finding is scored before it is discussed, so the conversation starts from a ranked list of remediable starting points, not a verdict. It is the evidence-against-requirement discipline of an ISO 9001-style audit, applied to personal information, and it suits a Johannesburg school or a small Gauteng firm as readily as a larger employer.
A first check you can do in an afternoon
A first check can be done in an afternoon:
- List every point where personal information comes in: website forms, onboarding, reception, CCTV, staff files, enrolment.
- For each one, write down the purpose, who else handles the information, and where it ends up.
- Read the notice sentence by sentence against that list, and mark any line the list does not support.
- Ask the people doing the work whether the notice describes what they do, and repeat the check whenever a system or provider changes. The post on POPIA documents and whether anyone uses them sets out the same one-minute test for seven other documents.
For organisations that want a starting point on where they stand across both Acts, the POPIA/PAIA Readiness Snapshot is a desktop, self-reported readiness rating. The same test applies to this site's own Privacy Policy: a published notice is only as good as its match with practice.
Related reading: