A practical POPIA checklist for a new workflow

Start with the first collection point and follow a sample record through forms, inboxes, shared drives, automation tools and the final business system. Include logs, backups, exported spreadsheets and connected AI tools.

Write down why each field is needed and who uses it. Ask the responsible reviewer to confirm the legal basis, notices and any special requirements for the information involved. Remove fields collected only because a template happened to include them.

Identify the business owner and each external provider. Ask which people and accounts can read, change, export or delete information. Check actual settings with a test user rather than relying on a policy statement.

Record applicable agreements and approved processing locations. If a provider changes or a new integration is added, repeat the review for that connection. A contract on file should correspond to the service and account actually being used.

Separate service notifications from promotions in your workflow design. Have the marketing rules checked against section 69 and the Regulator’s direct-marketing guidance; also check the chosen channel’s policy.

Use a test contact to verify that an opt-out reaches every relevant sending system. Check a delayed job and a reimported contact, since either can accidentally restart messages after a preference has changed.

Create a synthetic customer with records in several systems. Try correcting a wrong address, finding the related records and applying the approved retention rule. Confirm what happens to historical copies and exports.

Set a clear route for access requests and record when the request arrived, identity checks, the assigned reviewer and the response. Use the applicable POPIA/PAIA procedure; do not assume one universal 21-working-day deadline.

Try a misdirected attachment, a lost device, an unavailable provider and an unexpected AI answer. Name who can pause the workflow, preserve relevant evidence and coordinate incident assessment.

Before release, record passed checks, unresolved gaps, the reviewer’s decision and the next review trigger. Aitsa can help implement agreed controls and evidence handling; specialist legal conclusions remain a separate responsibility.