Five years on, the grace period is over. What the law actually asks of you is smaller than the consultants claim.
The enforcement is real now
POPIA applies to almost every business in South Africa that touches personal information, which means almost every business. If you hold a customer database, you're in scope. The regulators have stopped making threats. Fines go up to R10 million, and jail time is on the table for the worst offences. What gets my attention is the personal liability: company executives can be held responsible in their own names, not just behind the p.r. shield of the company.
What the law actually asks
Strip away the 100-page consultant deck and the duties are practical. Know what personal data you hold and why. Know who can access it. Get consent where you need it, and be able to prove you got it. Have an Information Officer registered with the regulator. When a breach happens, notify the Information Regulator and the affected people within a reasonable time. That's the core. Most businesses fail not because the law is complicated but because nobody ever sat down and answered those questions once.
Where we fit in
The paperwork is yours to sign, but the infrastructure side is ours. Local hosting keeps data where you can actually account for it. Access controls, encrypted backups, and audit trails make compliance demonstrable, and demonstrable is what you need when a regulator comes asking. Aspirational compliance doesn't survive an audit.
Unsure where you stand? Talk to us. We'll look at how your data actually flows and tell you what's missing.