For South African organisations
Comprehensive Gap Assessment
A structured look at how your organisation handles personal information, tested against what actually happens, with a clear plan for what to fix first.
Fully standalone. No obligation to go further.
Who it’s for
Do our documents match what we actually do?
- You want a verified picture of where you stand on POPIA and PAIA, not only a self-reported one.
- You handle personal information across several teams, sites or service providers, and want to see how it all fits together.
- You have seen a first readiness rating and want it tested against what happens day to day.
- You are about to build or refresh your compliance framework and want to know what it needs to cover.
What you get
Scored findings, a roadmap and a conversation about them.
Document review
Your policies, notices, agreements and registers are read against POPIA and PAIA requirements.
Role-based interviews
Conversations with management, IT and security, operations and frontline, and field or mobile staff.
On-site verification
A live check of what happens in practice, set against what your documents say.
Scored findings
Each finding is scored on severity and likelihood and given an effort rating, before we discuss it.
Report and roadmap
A final assessment report with the evidence for each finding and a prioritised remediation roadmap.
What the assessment covers
POPIA across all eight conditions for lawful processing, and your PAIA obligations.
- Accountability
- Processing limitation
- Purpose specification
- Further processing limitation
- Information quality
- Openness
- Security safeguards
- Data subject participation
- PAIA section 51 manual
- Processing of PAIA requests
- PAIA fee schedule
- Retrievability of records
Scope, sites and the people to involve are agreed with you before any work begins.
How it works
Four stages, agreed with you at the start.
- 1
Scope and agree
We talk through your organisation, sites and the people to involve, and agree the scope in writing before work begins.
- 2
Documents and interviews
You share your documents. I interview people across the organisation, role by role.
- 3
Verify on site
I check what happens in practice against what your documents say.
- 4
Findings and report
A findings session first, where factual corrections are taken, then the final report and roadmap.
What it is and isn’t
Being clear about what the assessment covers.
What it is
- A verified diagnostic: what your documents say, tested against what happens.
- Findings scored before they are discussed, with the evidence behind each one.
- A prioritised roadmap of remediable starting points, not verdicts.
What it isn’t
- Not a certification, and not a pass or fail audit result.
- Not the building of your policies. The Implementation Programme is there to help with that.
- Not legal advice.
Nothing here is legal advice. For legal questions, please speak to qualified legal counsel.
What happens next
Your next step is yours to choose.
After the final report you can work through the roadmap with your own team, or ask me to help build what it calls for through the Implementation Programme.
The assessment stands on its own, with no obligation to go further.
Prefer to start smaller? The POPIA/PAIA Readiness Snapshot is a lighter first look, for organisations of up to 100 staff on one site. And if you are unsure which fits, just get in touch and we will talk it through.
Why Kevin
Fifteen years, one standard.
I am an independent POPIA and PAIA consultant based in Johannesburg. I have spent fifteen years building compliance and risk frameworks across a wide range of operational environments, each different enough to need a tailored approach rather than a repeated template. I hold the NEBOSH International General Certificate (Distinction) and an ISO management systems auditor certification.
Working with Kevin Bishop Consulting is personal. You deal with me directly, from the first conversation to handover. The person who scopes your work is the person who does it, and you can reach me when you need to, without going through layers of account managers.
My approach is practical. A policy only protects people when the organisation understands it and uses it, so the work is built around how you actually operate.
To read more of how I approach POPIA and PAIA, see my note on the PAIA section 51 manual.
Questions
Common questions.
How is this different from the Readiness Snapshot?
The Snapshot is a desktop rating based on what you report to me, with no site visit. The Comprehensive Gap Assessment tests your documents against what happens in practice, through interviews and on-site verification.
Who needs to be involved from our side?
Ideally your Information Officer, or whoever leads privacy and compliance. Interviews cover management, IT and security, operations and frontline staff, and field or mobile staff where you have them.
Does the assessment include writing our policies?
No. The assessment shows what is missing and what to fix first. If you would like help building it, the Implementation Programme is there for that.
Do we have to continue to implementation?
No. The assessment is fully standalone, and the roadmap is yours to use as you see fit.
What if we have already done some compliance work?
Tell me what you have. Existing documents and earlier reviews help shape the scope, so you are not starting from zero.
Is this legal advice?
No. It is a structured assessment of your documents and practice. For legal questions, please speak to qualified legal counsel.
Get in touch
Find out where you really stand.
Email me and we will talk through your organisation and what an assessment would cover.
kevin@kevinbishop.co.za · Johannesburg, Gauteng, South Africa