The eight conditions
| Condition | What it requires | Evidence an inspector expects |
|---|---|---|
| 1. Accountability | The responsible party ensures the conditions are met | A privacy programme with named owners |
| 2. Processing limitation | Lawful, minimal processing with a justification, collected directly where possible | A lawful basis per processing activity |
| 3. Purpose specification | A specific, explicit purpose; records kept no longer than needed | Purposes and retention periods in your records |
| 4. Further processing limitation | New uses compatible with the original purpose | Compatibility assessments for new uses |
| 5. Information quality | Information complete, accurate and up to date | Data correction processes |
| 6. Openness | Documentation of processing and notice to data subjects | A PAIA manual and privacy notices |
| 7. Security safeguards | Appropriate, reasonable technical and organisational measures | Security controls, operator contracts and a breach procedure |
| 8. Data subject participation | Access to and correction of personal information | A request process with response records |
The checklist
- Register your Information Officer, and any deputies, with the Information Regulator
- Publish a PAIA manual describing your records and how to request them
- Build a record of processing: what you hold, why, on what basis, for how long, and who receives it
- Put written contracts in place with every operator (processor) under sections 20 and 21
- Get opt-in consent before electronic direct marketing to non-customers (section 69)
- Check the conditions for every transfer outside South Africa (section 72)
- Apply the stricter rules for special personal information and children's information
- Have a security compromise procedure that meets section 22
- Train staff, and keep the completion records
Enforcement
The Information Regulator can issue enforcement notices and administrative fines of up to R10 million. Some offences, including obstructing the Regulator and unlawful handling of account numbers, carry up to ten years' imprisonment on conviction.
hlola maps POPIA into controls grouped by condition, each with the evidence it needs. See POPIA in hlola.
Common questions
What are the eight conditions of POPIA?
Accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation.
Does POPIA apply to companies' information?
Yes. Unlike most data protection laws, POPIA protects the personal information of juristic persons as well as natural persons.
What is the maximum POPIA fine?
The Information Regulator can impose administrative fines of up to R10 million; some offences carry imprisonment of up to ten years.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.