Ten questions about how your organisation looks after personal information. You'll get a score, the gaps that matter most with what to do about each, and a one-page report to share.
The head of your organisation is the information officer unless they've formally authorised someone else - and they must be registered.
File shares, mailboxes, cloud drives, the HR and payroll systems, old backups.
Consent, a contract, a legal obligation or a legitimate interest - and you collect no more than you need.
POPIA says records are kept only as long as the purpose, the law or a contract needs them.
Folders, systems and mailboxes that hold it - including people who've changed roles or left.
Every laptop and server, including the ones at branches and at home.
Payroll, IT support, cloud services, marketing agencies - POPIA calls them operators.
The Information Regulator and the people affected, as soon as reasonably possible (section 22).
People can ask what you hold, who has had it, and for corrections or deletion.
On your website and at your offices: what you collect, why, and how to ask for it.
Nothing you answer here is stored. A guide to where you stand, not legal advice.