For South African organisations
POPIA/PAIA Readiness Snapshot
A clear POPIA readiness rating and a ranked list of what to fix first, so you know where you stand.
A starting point, not a verdict.
Who it’s for
Where do we stand on POPIA?
- You’re not sure where you stand on POPIA and PAIA, and want an honest first answer.
- A client, supplier or your board has asked about your POPIA readiness.
- You want a ranked list of what to fix first, rather than a long list with no order.
- Your organisation has up to 100 staff, operates from one site and has no known incident.
What you get
A readiness rating, ranked priorities and a conversation.
A readiness score
One overall score across 16 areas of POPIA and PAIA readiness.
Red, Amber or Green
A rating for each area, so you can see strengths and gaps at a glance.
Ten ranked gaps
The ten priority gaps, in the order I would tackle them.
A short report
Plain language, written to be read by a busy director or manager.
A one-hour readout
A call to walk through the results and answer your questions.
The 16 areas covered
Each area is rated Red, Amber or Green.
- Information Officer
- Governance
- Lawful basis and consent
- Purpose, retention and destruction
- Information quality and records of processing
- Privacy notice and openness
- PAIA manual and requests
- Security safeguards
- Operators (service providers)
- Security compromise readiness
- Data subject requests
- Children’s information
- Special personal information
- Direct marketing
- Cross-border transfers
- Staff awareness
Four of these can be marked not applicable: children’s information, special personal information, direct marketing and cross-border transfers.
Your overall result, in plain words
Foundational
The basics are not yet in place. The report shows where to begin.
Developing
Some things are working and some are missing. The report shows which to close first.
Established
The core is in place. The report points to what is left to tighten.
How it works
Four simple steps.
- 1
You get in touch
Email me and I’ll send the service sheet and answer your questions.
- 2
You share your answers
You tell me how your organisation handles personal information today, area by area.
- 3
I rate and rank
I score each area, rate it Red, Amber or Green, and rank the ten priority gaps.
- 4
We talk it through
You receive the short report, followed by a one-hour readout call.
What it is and isn’t
Being clear about what the Snapshot covers.
What it is
- A desktop review of the readiness you report to me.
- A quick, low-effort way to see where you stand.
- A ranked list of what to fix first.
What it isn’t
- Not the Comprehensive Gap Assessment.
- No site visit, and no testing of your documents against what happens in practice.
- Not legal advice.
Nothing here is legal advice. For legal questions, please speak to qualified legal counsel.
What happens next
Your next step is yours to choose.
After the readout call you have two sensible options. You can work through the priority list yourselves. Or you can move to the Comprehensive Gap Assessment, which tests your documents against what happens in practice, with on-site verification.
There is no pressure either way. The Snapshot stands on its own.
Why Kevin
Fifteen years, one standard.
I am an independent POPIA and PAIA consultant based in Johannesburg. I have spent fifteen years building compliance and risk frameworks across a wide range of operational environments, each different enough to need a tailored approach rather than a repeated template. I hold the NEBOSH International General Certificate (Distinction) and an ISO management systems auditor certification.
Working with Kevin Bishop Consulting is personal. You deal with me directly, from the first conversation to handover. The person who scopes your work is the person who does it, and you can reach me when you need to, without going through layers of account managers.
My approach is practical. A policy only protects people when the organisation understands it and uses it, so the work is built around how you actually operate.
To read more of how I approach POPIA and PAIA, see my note on the PAIA section 51 manual.
Questions
Common questions.
Is this the same as the Comprehensive Gap Assessment?
No. The Snapshot is a desktop review of the readiness you report to me. The Comprehensive Gap Assessment tests your documents against what happens in practice, with on-site verification.
What if we have more than 100 staff, or several sites?
The Snapshot suits organisations of up to 100 staff, one legal entity and one site. Larger or more complex organisations are better served by the Comprehensive Gap Assessment.
Do you need access to our systems?
No. The Snapshot is a desktop exercise based on what you report. There is no site visit and no testing of your systems.
Is the Snapshot legal advice?
No. It is a readiness rating and a ranked list of priorities. For legal questions, please speak to qualified legal counsel.
Who should be involved from our side?
Ideally your Information Officer, or whoever looks after privacy and compliance, together with someone who knows how your teams handle personal information day to day.
Get in touch
Find out where you stand.
Email me and I’ll send the service sheet for the Readiness Snapshot.
kevin@kevinbishop.co.za · Johannesburg, Gauteng, South Africa