# POPIA Compliance Assessment Record

## Organisation Details

| Field | Value |
|-------|-------|
| **Organisation Name** | [Legal entity name] |
| **Registration Number** | [Company registration] |
| **Information Officer** | [Name, designation] |
| **Deputy Information Officers** | [Names, areas of responsibility] |
| **Information Regulator Registration** | [Registration number / Pending] |
| **Assessment Date** | [YYYY-MM-DD] |
| **Assessor** | [Name, Title] |

## Applicability Determination

| Factor | Assessment |
|--------|-----------|
| **Domiciled in South Africa?** | [Yes / No] |
| **Uses means within South Africa?** | [Yes / No] |
| **Processes natural person data?** | [Yes / No] |
| **Processes juristic person data?** | [Yes / No] |
| **Exclusions applicable?** | [None / Specify: personal, national security, judicial, journalistic] |
| **POPIA Applicable?** | [Yes / No] |

## Condition-by-Condition Compliance Assessment

### Condition 1: Accountability (Section 8)

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Information Officer designated | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Information Officer registered | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Compliance programme in place | [Compliant / Non-compliant] | [Reference] | [Gap description] |

### Condition 2: Processing Limitation (Sections 9-12)

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Lawful basis identified per activity | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Consent is voluntary, specific, informed | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Collection adequate, relevant, not excessive | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Direct collection from data subject | [Compliant / Non-compliant] | [Reference] | [Gap description] |

### Condition 3: Purpose Specification (Sections 13-14)

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Specific, explicit, lawful purpose defined | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Retention periods defined | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Destruction when no longer needed | [Compliant / Non-compliant] | [Reference] | [Gap description] |

### Condition 4: Further Processing Limitation (Section 15)

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Compatibility assessment performed | [Compliant / Non-compliant] | [Reference] | [Gap description] |

### Condition 5: Information Quality (Section 16)

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Accuracy and completeness measures | [Compliant / Non-compliant] | [Reference] | [Gap description] |

### Condition 6: Openness (Sections 17-18)

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Section 18 notification at collection | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| PAIA manual updated | [Compliant / Non-compliant] | [Reference] | [Gap description] |

### Condition 7: Security Safeguards (Sections 19-22)

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Technical measures appropriate | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Organisational measures appropriate | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Operator contracts include Section 21 | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Breach notification procedure (Section 22) | [Compliant / Non-compliant] | [Reference] | [Gap description] |

### Condition 8: Data Subject Participation (Sections 23-25)

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Access request procedure | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Correction request procedure | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Deletion request procedure | [Compliant / Non-compliant] | [Reference] | [Gap description] |
| Response within reasonable time | [Compliant / Non-compliant] | [Reference] | [Gap description] |

## Special Personal Information (Sections 26-33)

| Category | Processed? | Lawful Basis | Safeguards |
|----------|-----------|-------------|------------|
| Religious or philosophical beliefs | [Yes / No] | [Section reference] | [Description] |
| Race or ethnic origin | [Yes / No] | [Section reference] | [Description] |
| Trade union membership | [Yes / No] | [Section reference] | [Description] |
| Political persuasion | [Yes / No] | [Section reference] | [Description] |
| Health data | [Yes / No] | [Section reference] | [Description] |
| Sex life | [Yes / No] | [Section reference] | [Description] |
| Biometric information | [Yes / No] | [Section reference] | [Description] |
| Criminal behaviour | [Yes / No] | [Section reference] | [Description] |

## Cross-Border Transfers (Section 72)

| Recipient | Country | Transfer Mechanism | Adequacy Assessment | Agreement Reference |
|-----------|---------|-------------------|--------------------|--------------------|
| [Recipient name] | [Country] | [Adequacy / BCR / Consent / Contract / Benefit / Public record] | [Adequate / Requires safeguards] | [Agreement ID] |

## Remediation Plan

| Gap | Priority | Action Required | Owner | Target Date | Status |
|-----|----------|----------------|-------|-------------|--------|
| [Gap 1] | [Critical / High / Medium / Low] | [Action] | [Name] | [YYYY-MM-DD] | [Open / In progress / Closed] |

## Sign-Off

| Role | Name | Signature | Date |
|------|------|-----------|------|
| Information Officer | [Name] | __________ | [YYYY-MM-DD] |
| Assessor | [Name] | __________ | [YYYY-MM-DD] |
| Executive Sponsor | [Name] | __________ | [YYYY-MM-DD] |

---

*This assessment is conducted under the Protection of Personal Information Act (POPIA), Act No. 4 of 2013, and reflects compliance status as of the assessment date.*