For South African organisations
Compliance Retainer
Continued support once your framework is live, keeping it current as your operations, tools and vendors change, and as POPIA and PAIA requirements evolve.
The level of support is matched to what you need.
Who it’s for
A framework only works if it stays current.
- Your framework is in place and you want it to stay current.
- Your Information Officer is new and would value a regular sounding board.
- Your tools, vendors or operations change, and your documents need to keep up.
- You want one person to call when a question or an incident comes up.
What you get
Practical support, month by month and year by year.
Annual compliance review
Your framework is reviewed once a year against how your organisation and the requirements have changed.
Documents kept current
Documents are updated when the law or your circumstances change, including a yearly check of your PAIA fee schedule.
Advice and check-ins
Practical advice by email, and regular check-ins with your Information Officer.
Day-to-day support
Help onboarding new operators, with regulatory correspondence, and with drafting and reviewing responses to data subject requests.
When something goes wrong
Support to assess and organise your response if you suspect a security compromise. Notification questions go to legal counsel.
What shapes the level of support
Support is scaled to your stage and your risks. These usually call for more hands-on support:
- The first year after implementation
- A new Information Officer
- A recently built framework
- A large number of operators
- A history of incidents
- Higher-risk sectors such as education, health and financial services
- Frequent changes in tools or vendors
Once the framework is embedded, a lighter arrangement usually fits. The recommendation is based on what you need, not on what earns more.
How it works
Four steps, starting at handover.
- 1
Start the conversation
Usually at handover, when we talk about what ongoing support would help. You are welcome to ask earlier.
- 2
Agree the level
We agree a level of support that fits your stage and your risks.
- 3
Work month to month
Advice, check-ins and help as questions come up.
- 4
Review each year
An annual review of the framework, with documents updated to match.
What it is and isn’t
Being clear about what the retainer covers.
What it is
- Ongoing practical support from the person who built your framework.
- A framework kept current as your organisation and the requirements change.
- One point of contact for questions, requests and incidents.
What it isn’t
- Not a replacement for your Information Officer, who remains responsible for the framework.
- Not legal advice or legal representation.
- Not a guarantee of any regulatory outcome.
Nothing here is legal advice. For legal questions, please speak to qualified legal counsel.
What happens next
Start the conversation at handover.
The conversation about ongoing support usually happens when the Implementation Programme is handed over, once you have seen how the framework works for your team. You are welcome to raise it earlier.
Still building your framework? Get in touch and we will talk through where you are. The Comprehensive Gap Assessment and the Implementation Programme are the usual route.
Why Kevin
Fifteen years, one standard.
I am an independent POPIA and PAIA consultant based in Johannesburg. I have spent fifteen years building compliance and risk frameworks across a wide range of operational environments, each different enough to need a tailored approach rather than a repeated template. I hold the NEBOSH International General Certificate (Distinction) and an ISO management systems auditor certification.
Working with Kevin Bishop Consulting is personal. You deal with me directly, from the first conversation to handover. The person who scopes your work is the person who does it, and you can reach me when you need to, without going through layers of account managers.
My approach is practical. A policy only protects people when the organisation understands it and uses it, so the work is built around how you actually operate.
To read more of how I approach POPIA and PAIA, see my note on the PAIA section 51 manual.
Questions
Common questions.
When does the retainer start?
Usually after the Implementation Programme, with the conversation at handover. If your situation is different, get in touch and we can talk it through.
How much support will we need?
It depends on your stage. Most organisations benefit from more hands-on support in the first year after implementation, and a lighter arrangement once the framework is embedded.
Does the retainer cover a security compromise?
It covers support to assess and organise your response. Questions about notification duties go to qualified legal counsel.
Does it replace our Information Officer?
No. Your Information Officer remains responsible for the framework. The retainer supports them.
Is this legal advice?
No. For legal questions, please speak to qualified legal counsel.
Get in touch
Keep your framework current.
Email me and we will talk through what ongoing support would look like for your organisation.
kevin@kevinbishop.co.za · Johannesburg, Gauteng, South Africa