The Protection of Personal Information Act, 2013 (POPIA) has been fully in force since 2021, and the Information Regulator has grown steadily less patient with businesses that treat it as a paper exercise. Your software stack — accounting, payroll, HR, CRM — is where most personal information actually lives, so that's where compliance is won or lost.
Map where personal information sits
Start with an inventory. Payroll systems hold ID numbers, tax numbers, bank details and salaries. CRMs hold customer contact data and behavioural history. HR systems hold everything from medical aid details to disciplinary records — much of it "special personal information" under POPIA that demands stricter handling.
Questions to ask every vendor
- Where is the data hosted, and does cross-border transfer meet POPIA's section 72 conditions?
- Is there an operator agreement available? (Under POPIA, your SaaS vendors are "operators" processing on your behalf.)
- What breach notification commitments does the vendor make, and in what timeframe?
- Can you export and delete data to honour data subject requests?
- Is access role-based, logged and reviewable?
Consent and direct marketing
POPIA's section 69 restricts electronic direct marketing to existing customers (for similar products) or people who have opted in. If you run newsletters or campaigns from your CRM, double opt-in with a consent audit trail is the defensible standard — check your marketing software records when and how consent was captured.
Don't forget the employees
Employee data enjoys the same protection as customer data. Payslips, IRP5s and HR records must be retained securely (SARS requires five years for payroll records) and disposed of properly afterwards. Employee self-service portals actually help here — data subjects accessing their own information directly is POPIA working as intended.
The takeaway
POPIA compliance is mostly good data hygiene enforced by law. Choose vendors that answer the questions above without flinching — the ones we review on this site are assessed with exactly this lens.