POPIA sounds like a legal nightmare, mostly because some people profit from making it sound that way. The actual obligations fit on one page, and a small business can cover them properly in a week.
The law has teeth now
If your business touches personal information, POPIA already applies to you. That means a customer list, a mailing database, employee records. In 2026 this stopped being theoretical. The Information Regulator is issuing fines that reach R10 million, and in serious cases an owner or executive can be held personally liable. I get more enquiries about POPIA than about any other topic, and the fear is always about the same thing: people genuinely do not know what data they hold.
What compliance actually asks of you
Four questions sit at the centre of it. What personal data do you hold, why do you hold it, who inside your business can see it, and how is it protected. Answer those honestly and you are further along than most of your competitors. Then there is the admin you cannot skip: register an Information Officer with the Regulator, collect consent properly at the point where you gather data, and report breaches when they happen. I know consultants who sell eighty-page frameworks for this. They make it sound like a six-figure project, and it does not need to be one.
Where the infrastructure matters
The law gets difficult when you cannot answer those four questions, and that is what happens when customer data is scattered across personal inboxes and a spreadsheet somebody's cousin maintains. Local hosting, real access controls, encrypted backups, and audit trails that actually record something: that is what makes compliance demonstrable. Demonstrable is the word that matters when the Regulator comes knocking, because on paper everyone is compliant until someone asks to see.
If you want this sorted, talk to us. We start by finding where your data actually lives, and that conversation usually takes less than an hour.