For South African organisations
Implementation Programme
End-to-end build-out of your POPIA and PAIA compliance framework, customised to your organisation and handed over for your team to run.
Operationalisation, not documentation.
Who it’s for
From a list of gaps to a framework your team uses.
- You know where your gaps are, from a Comprehensive Gap Assessment or a review of your own, and want them closed.
- You want the framework built, not just a list of what is missing.
- You want your own Information Officer and team to run it afterwards.
- You want documents that reflect how your organisation really works, not generic templates.
- You are not sure where to start and would like to talk it through.
What you get
A customised toolkit, built around how you work.
Governance
Information Officer designation record and registration support, Data Protection Policy, PAIA manual and request guidance.
Incidents and rights
A security compromise response procedure, and procedures and forms for data subject and PAIA requests.
Notices and consent
Privacy notices for customers and staff, website privacy policy, monitoring notice and consent forms.
Operators
Operator agreement template, agreements put in place with your service providers, and a platform privacy assessment.
People and registers
A staff awareness session and guide, an annual review checklist and your compliance register.
The compliance register
One workbook that your team keeps up to date, with a sheet for each of these.
- Records of processing
- Children’s information
- Special personal information
- Operators
- Security compromise register
- PAIA requests
- Data subject requests
- Retention schedule
- Destruction log
- Training record
- Accountability record
- Review outcomes
Delivered populated for your organisation, so your team starts from a working record.
How it works
Four stages, from roadmap to handover.
- 1
Start from your gaps
We confirm the priorities, usually from a Comprehensive Gap Assessment or an earlier review of your own.
- 2
Customise and build
The toolkit is adapted to your organisation, operator agreements are put in place and your registers are populated.
- 3
Register and train
Support with Information Officer registration, and a staff awareness session.
- 4
Hand over
You receive the completed toolkit, and your Information Officer signs off the handover.
What it is and isn’t
Being clear about what the programme covers.
What it is
- A framework tailored to how your organisation operates.
- Purpose-built for South African law, not adapted from foreign frameworks.
- Built so your own people can run it after handover.
What it isn’t
- Not a guarantee of any regulatory outcome.
- Not ongoing support afterwards. The Compliance Retainer is there if you would like it.
- Not legal advice. Where a document needs legal review, I will say so.
Nothing here is legal advice. For legal questions, please speak to qualified legal counsel.
What happens next
After handover, the framework is yours to run.
Once the framework is handed over, your Information Officer and team run it day to day. At handover we can also talk about whether ongoing support would help. That is the Compliance Retainer.
Not sure where you are yet? You are welcome to get in touch at any stage. A Comprehensive Gap Assessment is often a sensible first step, because it shows where the effort should go. We can talk through your situation and agree what makes sense.
Why Kevin
Fifteen years, one standard.
I am an independent POPIA and PAIA consultant based in Johannesburg. I have spent fifteen years building compliance and risk frameworks across a wide range of operational environments, each different enough to need a tailored approach rather than a repeated template. I hold the NEBOSH International General Certificate (Distinction) and an ISO management systems auditor certification.
Working with Kevin Bishop Consulting is personal. You deal with me directly, from the first conversation to handover. The person who scopes your work is the person who does it, and you can reach me when you need to, without going through layers of account managers.
My approach is practical. A policy only protects people when the organisation understands it and uses it, so the work is built around how you actually operate.
To read more of how I approach POPIA and PAIA, see my note on the PAIA section 51 manual.
Questions
Common questions.
Do we need an assessment first?
It depends where you are. Implementation works best when it starts from a clear view of your gaps. If you already have one, we can build from that. If not, the Comprehensive Gap Assessment is the usual way to get it. Either way, get in touch and we will agree a sensible starting point.
Will we get generic templates?
No. The toolkit is customised to your organisation, and built for South African law, not adapted from foreign frameworks.
Do you register our Information Officer?
I support the registration process. Your organisation designates its Information Officer, and the designation record is part of the toolkit.
Does it include staff training?
Yes. The programme includes a staff awareness session and a staff guide.
Is this legal advice?
No. The documents are working tools for your organisation. For legal questions, please speak to qualified legal counsel.
Get in touch
Build a framework your team can run.
Email me and we will talk through where you are and what the build would involve.
kevin@kevinbishop.co.za · Johannesburg, Gauteng, South Africa