1. Awareness & Accountability:

• Have you designated a responsible person for data protection compliance?
• Is there awareness among employees regarding their roles and responsibilities under POPIA?
• 
  

2. Data Processing:

Do you have procedures in place for obtaining and processing personal information lawfully?

• Have you implemented measures to ensure the accuracy and security of personal data?
• 
  

3. Consent and Purpose Limitation:

• Do you obtain consent from individuals before collecting their personal information?
• Is personal data collected only for specified, explicit, and legitimate purposes?
• 
  

4. Data Subject Rights:

• Are mechanisms in place to facilitate data subject rights, such as access, correction, and deletion of personal information?
• Do you have procedures for handling data subject requests within the prescribed timelines?
• 
  

5. Data Security Measures:

• Have you implemented appropriate measures to safeguard personal data against unauthorized access, disclosure, alteration, or destruction?
• 
  

6. Data Transfers and Processing Outside South Africa:

• Do you have safeguards in place when transferring personal data outside South Africa?
• Are contracts with third parties processing personal data on your behalf compliant with POPIA requirements?
• 
  

7. Data Breach Response Plan:

• Have you developed a response plan outlining procedures for detecting, reporting, and responding to data breaches?
• Is there a designated person responsible for managing data breach incidents?
• 
  

8. Record-Keeping and Documentation:

• Do you maintain records of processing activities as required by POPIA?
• Have you documented policies, procedures, and agreements related to personal data processing?
• 
  

9. Regular Compliance Reviews:

• Do you conduct periodic assessments and audits to evaluate compliance with POPIA?
• Are corrective actions taken to address any identified non-compliance or gaps in data protection measures?
• 
  

10. Employee Training and Awareness:

• Have you provided training to employees on their obligations under POPIA and data protection best practices?
• Do employees understand the importance of protecting personal information and their role in maintaining compliance?