Question 1

Have you formally appointed an Information Officer and registered them with the Information Regulator?

Accepted Answer

Under POPIA, every responsible party must designate an Information Officer and register them with the Information Regulator. Limesys can help assess whether your appointment and registration meet regulatory requirements.

Question 2

Do you obtain explicit consent from customers before collecting their personal information?

Accepted Answer

Lawful processing under POPIA often requires explicit, informed consent before collecting personal information. A POPIA gap assessment identifies where consent mechanisms are missing or inadequate.

Question 3

Do you have a written privacy policy that clearly explains why you collect personal data?

Accepted Answer

A clear, accessible privacy policy is a core POPIA requirement. It must explain what data you collect, why, and how it is used and protected.

Question 4

Is your website protected by HTTPS and up-to-date security patches?

Accepted Answer

POPIA requires appropriate security safeguards. HTTPS and timely patching are baseline controls for protecting personal information processed through your website.

Question 5

Do you use unique passwords and multi-factor authentication on business-critical systems?

Accepted Answer

Strong access controls — unique credentials and MFA — reduce the risk of unauthorised access to systems containing personal information.

Question 6

Have you signed data processing agreements with all third-party vendors handling your customer data?

Accepted Answer

When operators process personal information on your behalf, POPIA requires written agreements that define roles, responsibilities, and security obligations.

Question 7

Do you have a documented plan for responding to and reporting a data breach within 72 hours?

Accepted Answer

A breach response plan ensures you can contain incidents quickly and meet POPIA notification obligations to the Information Regulator and affected data subjects.

Question 8

Have your staff received formal training on POPIA and phishing awareness in the last 12 months?

Accepted Answer

Staff awareness is a critical safeguard. Regular POPIA and phishing training reduces human-error breaches and supports ongoing compliance.

See the Gaps Before They Do.

Compliance as Infrastructure

POPIA Gap Assessment

Website Security Review

Security Awareness Training

Built for the South African regulatory reality.

Built for South African businesses, by South African specialists.

POPIA specialists with hands-on technical execution.

Most assessments delivered in 5 business days.

Prioritised remediation, not checklist theatre.

Assess your regulatory exposure in 2 minutes.

Immediate response protocols.

Book a free 15-minute consultation.