Build a POPIA framework your team can actually use

Use one row per workflow: purpose, business owner, information involved, collection point, systems and providers, access groups, retention decision, reviewer and evidence links. This is a proposed working structure, not a prescribed statutory form.

For example, a contractor document register might name the person who requests records, the reviewer who checks them and the person who approves access. Keep a file’s existence separate from whether its contents meet the actual requirement.

For each agreed requirement, describe the action, frequency, responsible person and evidence. “Access is controlled” is too broad to test. “The owner reviews the access list after a staff change and records removals” is observable.

Ask the appropriate reviewer to map legal obligations to those controls. POPIA’s eight conditions include accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. They are a framework for assessment, not a checklist of eight documents.

When someone proposes a new app, capture its intended use, information categories, account owner and relevant terms. Record the decision before connecting production records. Keep the supplier evidence linked to the process that uses it.

Include a review trigger for new features, changed processing locations or additional subcontractors. A contract review made for one service should not silently approve every future integration.

Use an exception record with the issue, potential impact, temporary control, responsible person and resolution evidence. Escalate gaps that need legal, security or business decisions rather than marking them complete to finish a project.

Build separate handling paths for privacy requests and suspected incidents. Run a short exercise: a customer disputes a record while the process owner is away. Someone should still be able to find the current record, identify the reviewer and track the response.

At a review, sample actual work: a recent staff departure, a supplier change, a correction and a closed exception. Check whether the stated control happened and whether the evidence can be found.

Aitsa can scope document ownership, reminders, approvals and evidence retrieval around this framework. Automation helps follow-through; it does not decide that a legal obligation has been satisfied.