POPIA Gap Assessment
A structured review of your data processing activities against POPIA's conditions for lawful processing. We document findings and prioritise remediation.
POPIA Compliance Consulting
Ruimsig
Headquarters
POPIA
Specialist Focus
Remote
Across South Africa
Free
Initial Assessment
The Cost of Getting POPIA Wrong
Most South African business owners know POPIA exists. Far fewer have documented how their organisation actually handles personal information — from client records and CV databases to marketing lists and employee files.
The Information Regulator has issued fines and enforcement notices against organisations that failed to meet basic conditions for lawful processing. For an SME, a single complaint can trigger an investigation that consumes weeks of management time, damages client trust, and results in administrative penalties that were entirely preventable.
Recruitment agencies holding thousands of CVs, marketing firms running email campaigns, IT companies processing client data on cloud platforms — each faces distinct POPIA obligations. Generic templates downloaded from the internet rarely reflect how your business actually operates.
The emotional toll matters too. Directors and business owners carry personal liability concerns. Staff become uncertain about what they can and cannot do with client data. Sales teams hesitate before launching campaigns. The uncertainty slows growth.
Compliance gaps compound over time. The cost of addressing them after a complaint, audit failure, or client dispute is almost always higher than acting proactively.
Understand where your business stands today.
Book Free AssessmentWhy POPIA Compliance Matters for Your Business
POPIA is not a one-time checkbox exercise. It requires ongoing accountability — knowing what personal information you hold, why you hold it, how long you keep it, who you share it with, and how you protect it.
For a recruitment agency in Gauteng, this means lawful processing of candidate CVs, consent for marketing communications, secure storage of ID numbers, and clear retention schedules. For an interior design firm, it means client contact details, project photographs, and supplier information handled consistently across your team.
Architectural practices processing building plans with owner details, IT companies hosting client environments, and professional service firms managing confidential client files — each must demonstrate compliance with POPIA's eight conditions for lawful processing.
Beyond regulatory risk, POPIA compliance signals professionalism to clients, partners, and insurers. Enterprise clients increasingly require evidence of data protection practices before signing service agreements.
Compliance Support Built for South African Businesses
South African businesses face a regulatory environment that continues to evolve. Organisations searching for POPIA compliance consulting South Africa need practical guidance — not theoretical frameworks designed for multinational corporations. Lexon Consulting Group bridges that gap for SMEs, agencies, and professional firms that need compliance support aligned with how they actually operate.
Whether you are based in Johannesburg, Cape Town, Durban, Pretoria, or operating remotely across South Africa, our virtual delivery model ensures you receive structured compliance support without the cost and delay of on-site consulting engagements. Every engagement begins with a free compliance assessment — a no-obligation consultation to understand your current position and recommend proportionate next steps.
We work with directors, business owners, and management teams who understand that compliance is a business enabler, not a box-ticking exercise. Documented POPIA practices, reviewed contracts, and structured risk management support client acquisition, tender submissions, and professional credibility in competitive markets.
Directors and business owners carry personal responsibility for governance and compliance oversight. Without documented frameworks, you rely on informal practices that may not withstand regulatory scrutiny, client audits, or insurance reviews. Lexon helps you build the paper trail and operational habits that demonstrate due diligence — proportionate to your business size and industry.
Our clients include recruitment agencies managing candidate databases, marketing firms running digital campaigns, IT companies hosting client environments, architectural practices handling project documentation, interior design studios managing client property information, and professional service firms maintaining confidential client records. Each industry faces distinct compliance priorities, and our support is tailored accordingly.
Many businesses delay compliance until a client, employee, or regulator forces the issue. By then, remediation costs more, takes longer, and often happens under pressure. Starting with a structured assessment — even if full implementation is phased — gives you control over timing, budget, and priorities.
Our approach is consultative: we explain what we find, recommend practical steps, and support implementation at a pace your team can manage alongside daily operations.
Topics we address
- POPIA compliance for South African businesses
- Data protection South Africa for South African businesses
- Information Officer for South African businesses
- Privacy policy for South African businesses
- PAIA manual for South African businesses
- Personal information act for South African businesses
- Data breach notification for South African businesses
- POPIA audit for South African businesses
Free compliance assessment: Every engagement with Lexon Consulting Group begins with a complimentary consultation. We review your current position, explain our recommended approach, and provide a clear proposal if you choose to proceed. Book your assessment today.
What Is Included
Practical compliance support tailored to your business.
Privacy Policy & PAIA Manual
Drafting and review of privacy notices, PAIA manuals, and consent mechanisms tailored to your business operations — not generic templates.
Data Mapping & Inventory
Identification of personal information flows across departments, systems, and third parties. Essential for recruitment agencies and IT companies handling client data.
Information Officer Support
Guidance on appointing and supporting your Information Officer, including role clarity, reporting structures, and Regulator registration requirements.
Third-Party Agreements
Review of data processing and sharing arrangements with suppliers, cloud providers, and subcontractors operating in South Africa.
Breach Response Planning
Practical breach notification procedures aligned with POPIA and Regulator expectations, so your team knows what to do if an incident occurs.
Outcomes You Can Expect
We measure success by reduced risk, clearer operations, and confidence to grow.
Reduced Regulatory Risk
Address POPIA gaps before they become complaints, investigations, or fines from the Information Regulator.
Client Confidence
Demonstrate to enterprise clients and partners that you take data protection seriously.
Staff Clarity
Give your team clear, practical guidance on handling personal information in daily operations.
Business Continuity
Remove uncertainty that slows marketing campaigns, hiring processes, and client onboarding.
Contract Readiness
Align privacy commitments in your service agreements with actual business practices.
Ongoing Compliance
Stay current with regulatory developments through retainer support or periodic reviews.
Why Choose Lexon Consulting Group
Trusted compliance support for businesses across South Africa.
Practical, not theoretical
We focus on what your business actually does with data — not abstract compliance theory.
SME-focused
Our frameworks are designed for businesses without dedicated legal or compliance departments.
South Africa expertise
We understand POPIA, PAIA, and the Information Regulator's expectations in the local context.
No legal advice
We provide compliance support and refer formal legal matters to qualified attorneys.
Industries We Support
Recruitment agencies
Processing candidate CVs, ID numbers, and background check data requires robust POPIA frameworks. We help agencies build lawful processing practices for talent databases.
Marketing agencies
Email marketing, lead generation, and analytics tools all involve personal information. We align your campaigns with POPIA consent and direct marketing requirements.
IT companies
Hosting, SaaS, and managed services involve processing client data. We support data mapping, subprocessors agreements, and client-facing privacy documentation.
Architectural firms
Client contact details, building plans with owner information, and contractor data require consistent handling across project teams.
Interior designers
Client preferences, home addresses, project photographs, and supplier contacts must be managed with clear retention and access controls.
Professional services
Law-adjacent, accounting, consulting, and advisory firms handling confidential client information benefit from structured POPIA compliance programmes.
Our Process
From first conversation to ongoing support.
1
Discovery
We learn about your business, industry, current compliance practices, and priorities through a structured consultation.
2
Assessment
We review documentation, conduct interviews, and identify gaps against POPIA, contractual, and operational requirements.
3
Implementation
We support remediation — policies, contracts, processes, and staff guidance — at a pace that suits your resources.
4
Ongoing Support
Through compliance retainers or periodic reviews, we help you maintain compliance as your business evolves.
Frequently Asked Questions
What is POPIA and who does it apply to?
The Protection of Personal Information Act [POPIA] is South Africa's data protection law. It applies to any organisation — public or private — that processes personal information. This includes SMEs, sole proprietors, NGOs, and large corporations. If your business collects names, email addresses, phone numbers, ID numbers, or any information relating to an identifiable person, POPIA likely applies to you.
Do I need to register with the Information Regulator?
Certain organisations must register Information Officers with the Information Regulator. Whether registration is required depends on your processing activities and whether you meet specified thresholds. During our assessment, we review your obligations and guide you through registration if applicable.
Can I use a free privacy policy template?
Generic templates rarely reflect your actual data processing activities. POPIA requires transparency about what information you collect, why, how long you retain it, and who you share it with. A template that does not match your operations creates compliance gaps and may mislead data subjects.
What is the role of an Information Officer?
Every responsible party must designate an Information Officer — typically a senior employee such as a director or CEO. The Information Officer oversees POPIA compliance, handles data subject requests, liaises with the Information Regulator, and ensures policies are implemented. We provide guidance on this role; formal legal appointment matters are referred to attorneys.
How long does POPIA compliance take?
A basic gap assessment and priority remediation can often be completed within four to eight weeks for an SME. More complex organisations — recruitment agencies with large databases, IT companies with multiple subprocessors — may require a phased programme over several months.
What are the penalties for POPIA non-compliance?
The Information Regulator may issue enforcement notices, impose administrative fines up to R10 million, and in serious cases refer matters for criminal prosecution. Beyond financial penalties, reputational damage and loss of client trust can exceed the direct cost of fines.
Does POPIA apply to employee data?
Yes. Employee personal information — HR records, payroll data, performance reviews — is personal information under POPIA and must be processed lawfully with appropriate security measures.
How does POPIA affect direct marketing?
Direct marketing by electronic communication requires consent unless an existing customer relationship exception applies. Marketing agencies and any business sending promotional emails must have documented consent mechanisms and opt-out processes.
What is a PAIA manual and do I need one?
A PAIA [Promotion of Access to Information Act] manual describes how your organisation handles requests for access to records. Private bodies with more than 50 employees [or certain revenue thresholds] must compile and publish a PAIA manual. We assist with preparation and review.
Can Lexon help during an Information Regulator investigation?
We provide compliance support to help you understand and respond to regulatory enquiries. We do not provide legal representation. If formal legal proceedings arise, we refer you to qualified attorneys.
Do you provide legal advice?
No. Lexon Consulting Group provides compliance support and practical guidance. We do not offer legal advice or representation. Formal legal matters are referred to qualified attorneys in South Africa.
How do I book a free compliance assessment?
Visit our contact page, email lexonconsults@gmail.com, or call +27 63 375 2721 (Mon–Fri, 09:00–17:00). We schedule a virtual consultation at no cost and with no obligation.
Do you work remotely across South Africa?
Yes. We support businesses in Johannesburg, Cape Town, Durban, Pretoria, and nationwide via virtual consultations, document review, and ongoing retainer support.
What happens after the assessment?
You receive a summary of findings and, where relevant, a proposal with scope, timelines, and fees. You choose whether to proceed.
Can we start with a once-off engagement?
Yes. Many clients begin with an audit, POPIA review, or contract review before moving to a compliance retainer.
What does compliance support cost?
Fees depend on scope, business size, and service tier. Retainers start from R299 per month. Project-based work such as audits and POPIA programmes are quoted after your free assessment. We provide clear proposals before any paid engagement begins.
How quickly can Lexon start working with us?
After your free assessment, most engagements commence within one to two weeks. Urgent contract reviews and priority POPIA matters can often be accommodated sooner by arrangement.