Who is the Information Officer of my company?

By default it is the head of the private body, such as the CEO or the owner of a sole proprietorship. Duties can be delegated to Deputy Information Officers, and officers must be registered with the Information Regulator.

Do I need a PAIA manual?

Section 51 of PAIA requires private bodies to compile a manual, but exemptions for certain small private bodies have applied at times. Check the Information Regulator's current guidance for your business.

What must I do after a data breach?

POPIA section 22 requires notification to the Information Regulator and the affected data subjects as soon as reasonably possible. Record what happened, what information was involved and the steps taken.

Does Compliance Junkie make my business POPIA compliant?

No software can do that on its own. Compliance Junkie gives you the documents, workflows and secure record-keeping; your organisation remains responsible for how it processes personal information.

POPIA compliance and your PAIA manual, without the paper chase

The Protection of Personal Information Act 4 of 2013 (POPIA) governs how South African organisations collect, use, store and share personal information. Employers process a lot of it: ID numbers, banking details, medical certificates, disciplinary records and more. The Promotion of Access to Information Act 2 of 2000 (PAIA) sits alongside POPIA and deals with how people can request access to records.

Compliance Junkie helps you keep the core POPIA and PAIA documents in one place, and protects the employee data you hold in the system itself.

Start your free 30-day trial See pricing

The building blocks of POPIA compliance

POPIA sets out conditions for the lawful processing of personal information, covering accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. Turning those conditions into practice usually involves a handful of documents and roles.

An Information Officer and, where needed, Deputy Information Officers, registered with the Information Regulator
A PAIA manual describing the records you hold and how to request access to them
Privacy notices for employees, job applicants, customers and suppliers
A records retention schedule, so information is not kept longer than needed
Operator agreements with service providers who process data on your behalf
A security compromise (breach) procedure and register

Information Officer and PAIA manual

For a private body, the head of the organisation (for example the CEO, or the owner of a sole proprietorship) is the Information Officer by default. The Information Officer can delegate duties to Deputy Information Officers in writing. Compliance Junkie generates the appointment letter for an employee or an external person, captures the signature and files it as a legal appointment.

Section 51 of PAIA requires private bodies to have a PAIA manual, although certain small private bodies have been granted exemptions from time to time. Check the Information Regulator's current notices for your situation. In Compliance Junkie you can upload a signed manual or generate one with the guided wizard, and keep each version with its status and history.

Security compromises

Section 22 of POPIA requires a responsible party to notify the Information Regulator and affected data subjects when there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, as soon as reasonably possible. A written procedure and a register help you respond quickly and consistently.

Protecting employee data in the system

Compliance Junkie uses role-based access, so people only see the employee information their role requires, and changes are logged in an audit trail. Data is encrypted in transit. Keeping HR records in one controlled system, rather than spread across spreadsheets and inboxes, makes it easier to apply the security safeguards POPIA expects.

Frequently asked questions

Who is the Information Officer of my company?: By default it is the head of the private body, such as the CEO or the owner of a sole proprietorship. Duties can be delegated to Deputy Information Officers, and officers must be registered with the Information Regulator.
Do I need a PAIA manual?: Section 51 of PAIA requires private bodies to compile a manual, but exemptions for certain small private bodies have applied at times. Check the Information Regulator's current guidance for your business.
What must I do after a data breach?: POPIA section 22 requires notification to the Information Regulator and the affected data subjects as soon as reasonably possible. Record what happened, what information was involved and the steps taken.
Does Compliance Junkie make my business POPIA compliant?: No software can do that on its own. Compliance Junkie gives you the documents, workflows and secure record-keeping; your organisation remains responsible for how it processes personal information.

Try Compliance Junkie free for 30 days

One company, no credit card needed. HR, labour relations, payroll, OHS and POPIA in one South African system.

Create your account

Not legal advice. This page is general information about South African legislation and how Compliance Junkie supports your record-keeping. It is not legal advice and may not reflect the latest amendments, regulations or court decisions. Consult a qualified labour, safety or privacy professional about your specific situation.