The POPIA compliance file every responsible party should be able to produce

A responsible party that can produce ten things on request is in reasonable shape: proof of Information Officer registration, a published PAIA manual, a documented accountability framework, records of any personal information impact assessments, written operator agreements, a security compromise response plan, an access and correction request log, retention and destruction records, and evidence of lawful consent for direct marketing.

Reviewed by TefCo Compliance Research — last verified 15 September 2026.

In short

Accountability under POPIA condition 1 means being able to demonstrate compliance, not just assert it.
An operator processing personal information on your behalf needs a written contract, not a verbal arrangement.
Direct marketing by electronic communication needs prior opt-in consent under section 69, with narrow exceptions.

Governance and registration

Information Officer (and any deputies) registered with the Information Regulator (POPIA section 55).
A written accountability framework showing how the eight conditions for lawful processing are implemented (POPIA section 8, POPIA Regulations regulation 4).
Personal information impact assessments for higher-risk processing, kept on file.
A PAIA manual, published and kept current, describing the body's structure and how to request records (PAIA section 51).
A record of processing activities: what personal information is held, why, and for how long.

Third parties and security

Written operator agreements for every third party that processes personal information on your behalf, requiring the operator to maintain the same security safeguards.
Documented technical and organisational security measures against loss, damage or unauthorised access (POPIA section 19).
A security compromise response plan naming who reports to the Information Regulator and how, using the current SCN1 process on the Regulator's eServices Portal.
A retention and destruction schedule showing personal information is not kept longer than necessary for the purpose it was collected.

The Information Regulator's own enforcement notices repeatedly cite the same two failures: no Information Officer registered, and no written operator contract in place. Both are free to fix and are usually the first thing checked.

Data subject requests and direct marketing

A logged process for access, correction and deletion requests under sections 23 to 25 of POPIA, with dated acknowledgements.
Evidence of prior opt-in consent for direct marketing by electronic communication, or reliance on the narrow existing-customer exception under section 69.
A working unsubscribe or opt-out mechanism on every marketing communication.
Special personal information and children's information processed only with the specific authorisations POPIA requires, where applicable.

Frequently asked

Does POPIA require a written contract with every supplier that touches personal information?

Yes, where that supplier is an operator processing personal information on your behalf. POPIA requires the processing to be governed by a written contract that obliges the operator to maintain confidentiality and the required security safeguards.

Can a business email its existing customer base without fresh consent?

Only within the narrow existing-customer exception the Regulator's Guidance Note on Direct Marketing describes, and only for similar products or services with an easy opt-out. New prospects need prior opt-in consent under section 69.

What is the single most common gap the Regulator finds?

Based on published enforcement notices, an unregistered Information Officer and the absence of a compliance framework demonstrating accountability are recurring findings across both public and private bodies.

Sources

TefCo Corporate Compliance (Pty) Ltd is a compliance management platform, not a legal, tax or advisory firm. This guide is general information, not advice. Fees, dates and thresholds change — confirm current figures with the regulator before you rely on them.