Question 1

What exactly does this policy comprise?

Accepted Answer

We tailor your Data Protection Policy to your organisation based on the types of personal information that you collect, what you do with it and how you would like external parties to deal with it.

Question 2

Who needs a POPI policy and why?

Accepted Answer

Any South African organisation that collects, processes, stores, or shares personal information from external parties (clients, suppliers, contractors, website visitors, etc.) needs a POPI Policy. This is a legal requirement under POPIA, which mandates that data subjects be informed about how their personal information is handled. Without a compliant POPI Policy, your organisation risks:

• Non-compliance penalties of up to R10 million or 10 years imprisonment
• Regulatory enforcement action by the Information Regulator
• Reputational damage and loss of customer trust
• Legal liability for data breaches
• Inability to legally process personal information

A POPI Policy demonstrates transparency, builds trust with data subjects, and is essential for POPIA compliance.

Question 3

How does this differ from a Workplace Policy?

Accepted Answer

A POPI Policy (Data Protection Policy) is aimed at external parties and informs them how your organisation handles their personal information. A Workplace Policy governs how your employees handle data internally. Many organisations need both. We also offer a [POPI Workplace Policy](/southafrica/southafrica-custom-popi-act-workplace-policy) for internal use.

Question 4

Is this the same as a Privacy Policy?

Accepted Answer

The terms are often used interchangeably. A POPI Policy or Data Protection Policy specifically addresses POPIA compliance, while a Privacy Policy may be broader. For websites and apps, we also offer a [Privacy Policy for websites and applications](/southafrica/southafrica-custom-privacy-policy-for-websites-software-or-applications).

Question 5

What are the legal consequences of not having a POPI policy?

Accepted Answer

Failure to have a compliant POPI Policy can result in severe consequences under POPIA. The Information Regulator can impose administrative fines of up to R10 million, or in cases of serious offences, criminal penalties including imprisonment for up to 10 years. Additionally, data subjects whose rights are violated can claim damages, and the Regulator can issue enforcement notices requiring you to stop processing personal information until compliance is achieved. Non-compliance also exposes your organisation to reputational damage, loss of business, and potential class action lawsuits. Having a properly drafted POPI Policy is your first line of defence and demonstrates good faith compliance efforts.

Question 6

What information must be included in a POPI policy?

Accepted Answer

A compliant POPI Policy must include:

• The identity and contact details of the responsible party (your organisation) and the Information Officer
• The purpose for which personal information is collected and processed
• Whether the supply of information is voluntary or mandatory and consequences of failure to provide it
• What personal information is collected and from which sources
• Who the information will be shared with (third parties, service providers, etc.)
• Whether information will be transferred outside South Africa
• Security measures taken to protect the information
• Data subject rights including access, correction, deletion, and objection rights
• How to lodge complaints with the Information Regulator
• Data retention periods and disposal procedures

Our custom policy ensures all these mandatory elements are included and tailored to your specific operations.

Question 7

How often should a POPI policy be updated?

Accepted Answer

Your POPI Policy should be reviewed and updated whenever there are material changes to how you collect, process, or share personal information. This includes: changes to your data processing activities, new services or products, changes in third-party service providers, updates to POPIA regulations or guidance, or after a data breach incident. As a best practice, conduct an annual review even if nothing has changed, to ensure ongoing compliance. If you make significant changes, you may need to notify existing data subjects. Our policy includes guidance on when updates are necessary, and we can assist with amendments as your business evolves.

Question 8

Where should a POPI policy be displayed or made available?

Accepted Answer

A POPI Policy must be easily accessible to data subjects. Common locations include:

• Your website footer with a clear link
• On forms where personal information is collected (application forms, contact forms, registration forms)
• In terms and conditions or service agreements
• Provided when entering into contracts with clients, suppliers, or contractors
• Made available upon request from any data subject

For digital platforms, it should be prominently linked and easily findable. The policy should be written in clear, plain language that data subjects can understand. Our custom policy is drafted to be user-friendly while remaining legally compliant, making it suitable for public display.

Question 9

How long does delivery take?

Accepted Answer

Standard delivery is 3 business days from when we receive your completed questionnaire. If you need your POPI Policy sooner, we offer an Express Delivery option which guarantees delivery within 1 business day. You can select Express Delivery as an add-on during checkout.

Question 10

What if I need changes to my policy?

Accepted Answer

Your order includes 2 rounds of revisions at no additional cost, which must be requested within 1 week of receiving your draft. This ensures you have ample opportunity to review the document and request any adjustments. Additional revision rounds beyond this can be arranged at a nominal fee.

Question 11

Who will draft my POPI Policy?

Accepted Answer

Your POPI Policy will be prepared by a qualified South African attorney with a minimum of 12 years of post-qualification experience in data protection and POPIA compliance. Our attorney specialises in helping organisations meet their POPIA obligations.

Question 12

What information will I need to provide?

Accepted Answer

After purchase, you'll receive a detailed questionnaire asking about your organisation, the types of personal information you collect, how you process and store it, who you share it with, and your data retention practices.

Question 13

Will my policy comply with POPIA?

Accepted Answer

Yes. Your POPI Policy will be drafted to comply with the Protection of Personal Information Act (POPIA) and related regulations. Our attorney ensures all required disclosures and data subject rights are properly addressed.

Custom POPI
Policy

Policy Details

Who Is This For

Tailored To Your Needs

Prepared By Experts

Benefits of a Data Protection Policy

External Data Guidelines

POPIA Compliance

Data Subject Rights

Attorney Drafted

Amendments Included

Information Regulator Ready

Join 6000+ Businesses Who Trust Us

Meet Some Of Your Expert Team

Tamara

Alicia

Johanna

Ayesha

Geraint

Kyle

Drew

Chris

Antonella

FAQs

Custom POPIPolicy