Data Privacy Audit in South Africa

A data privacy audit in South Africa is an independent review of how your organisation handles personal information against the Protection of Personal Information Act (POPIA), enforced by the Information Regulator, including the eight conditions for lawful processing and the breach-notification duty. We map your data, test the POPIA conditions, review transfers and breach readiness, and hand you a prioritised, audit-ready report.

Which data-protection laws apply to you in South Africa?

POPIA is fully in force and the Information Regulator is active. An audit is only useful if it is scoped to the obligations that actually apply to you:

• POPIA — the Protection of Personal Information Act, with eight conditions for lawful processing: accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards and data-subject participation.
• Breach notification — the duty to notify the Information Regulator and affected data subjects of security compromises.
• Information Officer — POPIA requires registration of an Information Officer responsible for compliance.
• Cross-border transfers — section 72’s conditions for transferring personal information outside South Africa.

What a CyberSigma South Africa privacy audit actually covers

We audit how personal data actually moves through your organisation against the law, not just your policy documents. In a typical engagement we:

• Map your personal data: build or validate a Record of Processing Activities (ROPA) and data-flow inventory, including what leaves the country.
• Test lawful basis and consent: how you collect, record and let people withdraw consent, and whether your lawful bases actually hold up.
• Check notices and transparency: do your privacy notices match what you really do with data?
• Exercise data-subject rights: walk a real access, correction, deletion and objection request through your process against the statutory clock.
• Confirm DPIAs: high-risk or large-scale processing should have a documented impact assessment.
• Review processors and cross-border transfers: vendor contracts, transfer mechanisms and the safeguards each law requires.
• Assess breach readiness: detection, and whether you can meet the notification deadline to the regulator and to affected people.
• Check retention and minimisation: you keep only what you need, only as long as you need it.

Representative engagement: a Johannesburg enterprise

A useful way to picture the work: a Johannesburg enterprise wanted to evidence POPIA compliance to its board and customers. We mapped its data, tested the eight conditions in practice, checked its Information Officer registration and breach process, reviewed its cross-border transfers, and delivered one remediation plan prioritised by regulatory risk. This example is representative of how we structure South Africa privacy audits; named client references are available under NDA on request. We are a cybersecurity and privacy assessor rather than a law firm, so for formal legal opinions we work alongside your data-protection counsel.

How long does a South Africa data privacy audit take, and what does it cost?

Most privacy audits run a few weeks end to end, depending on how many systems, vendors and data flows are in scope. Cost follows that scope rather than a fixed list price, so we run a short, free discovery call, agree the scope in writing, and give you a fixed quote before any work starts. If you are working to an Information Regulator, customer or audit deadline, tell us the date and we will tell you honestly whether it is achievable.

Who enforces data protection in South Africa?

The Information Regulator enforces POPIA. We map our findings to POPIA’s eight conditions and the records the Regulator would expect to see.

What are POPIA’s eight conditions?

Accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards and data-subject participation. We test each condition against how your organisation actually operates.

Do we need to register an Information Officer?

Yes. POPIA requires organisations to register an Information Officer with the Information Regulator. We check that the role is registered, real and resourced.

Is breach notification required under POPIA?

Yes. Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, you must notify the Information Regulator and affected data subjects. We assess whether you can meet that duty in practice.

How often should we run a privacy audit?

At least annually, and again after any major change — a new product, a new vendor handling personal information, a new market, or a breach.