Privacy guide
A practical POPIA checklist for business software buyers
The questions worth asking about personal information, access, providers, retention and what happens when a contract ends.
POPIA does not tell you which software to buy. It does tell you that you remain responsible for personal information after you hand it to a provider, which makes a few questions worth asking before you sign.
What POPIA actually asks of a buyer
The Protection of Personal Information Act 4 of 2013 makes the business that decides why and how personal information is processed the responsible party. Your software provider is usually an operator acting on your instructions. Choosing an operator does not transfer your responsibility to them.
In practice that means you need to know what personal information the system will hold, why it is there, who can see it, where it lives and how long it is kept. Those are all answerable before you buy, and they are much harder to fix afterwards.
Ask where the data physically sits
Most cloud software sold here stores data outside South Africa. That is lawful. Section 72 permits cross border transfer where the recipient is subject to comparable protection, usually through the provider's contractual terms.
What you cannot do is not know. Ask which region hosts your data, ask for it in writing, and keep the answer with your records. If a provider cannot tell you, that is itself the answer.
Access, roles and who can see a salary
Payroll and HR systems hold some of the most sensitive information a business has. Check what role based access the product supports and whether you can restrict salary visibility to the two people who need it rather than everyone in the finance team.
Ask also whether administrator actions are logged. If somebody exports the whole employee database, you should be able to tell that it happened and who did it.
Retention and deletion
POPIA says personal information should not be kept longer than necessary for the purpose it was collected for, subject to other laws that require you to keep records. Payroll records have their own retention requirements, so this is a balance rather than a rule to delete everything quickly.
The practical question for software is whether the product lets you delete a record when you decide to, or whether everything is retained indefinitely because that was easier to build.
Getting your data out
Ask what happens at the end of the contract. Can you export everything in a usable format, how long do you have to do it, and what does the provider do with what remains.
This matters for POPIA and it matters commercially. A provider whose export is a PDF has made switching expensive, and that is a fact worth knowing before you commit rather than three years later.
Remove access when people leave
The most common real world breach in a small business is not a hacked provider. It is a former employee or a former bookkeeper whose login still works months after they stopped working for you.
Make removing access part of the leaving process, alongside the laptop and the keys. Check quarterly who has access to payroll and to the accounting file, because that list grows quietly.
Common questions
01Does POPIA allow South African businesses to use overseas cloud software?
Yes. Section 72 permits transferring personal information outside the country where the recipient is bound by comparable protection, which is normally handled through the provider's contract terms. You must know it is happening and be able to explain it.
02Who is the Information Officer for a small business?
By default the head of the business, though the role can be delegated. It must be registered with the Information Regulator. For a sole proprietor it is simply the owner.
03Does POPIA require me to keep data in South Africa?
No. There is no data residency requirement in POPIA. What it requires is a lawful basis for the transfer and an appropriate level of protection at the destination.
Editorial note
This guide is general buying guidance and not accounting, legal or tax advice. Amounts and deadlines set by SARS change, so confirm the current figures for your own business before you rely on them.