A POPIA compliance checklist must connect legal duties to the way information is collected, used, shared, secured, retained, and deleted. ISO/IEC 27001:2022 can provide the management system that makes many of those controls repeatable and auditable. It does not, however, certify that an organisation complies with the Protection of Personal Information Act.
POPIA sets eight conditions for lawful processing. ISO 27001 establishes an information security management system, or ISMS, built around risk management and continual improvement. Used together, they help an organisation turn privacy obligations into assigned responsibilities, controlled processes, evidence, and management oversight. The checklist below highlights the connection without treating a voluntary standard as a substitute for South African law or specialist legal advice.
Establish accountability and governance
Confirm which entities are responsible parties and which service providers act as operators. Register and support the Information Officer as required, define privacy responsibilities, and report material risks to leadership. Create an information security governance structure that includes legal, technology, human resources, procurement, operations, and communications.
ISO 27001 clauses on organisational context, leadership, planning, support, and performance evaluation help formalise this governance. Set an ISMS scope that covers relevant personal information, systems, sites, people, and suppliers. A narrow technical scope may leave major POPIA activities outside the system.
Maintain a current view of legal, regulatory, contractual, and business requirements. POPIA should feed into the ISMS risk assessment and control design, while privacy risks should be visible in management review. Read the WWISE ISO 27001 overview when aligning information security with business processes.
Map personal information and lawful processing
Create a practical record of processing activities. Identify what personal information is processed, whose information it is, where it comes from, the purpose, lawful basis, systems, users, recipients, cross border transfers, retention period, and disposal method. Include paper records, email, messaging platforms, backups, cloud services, and shadow systems.
Test processing against POPIA’s conditions:
- accountability;
- processing limitation;
- purpose specification;
- further processing limitation;
- information quality;
- openness;
- security safeguards; and
- data subject participation.
ISO 27001 will not decide whether consent or another justification is lawful. Legal and privacy specialists must interpret POPIA. The ISMS can then control the approved purpose, access, transfer, retention, and change process.
Use ISO 27001 to support security safeguards
Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. The responsible party must identify foreseeable internal and external risks, establish safeguards, verify their effectiveness regularly, and update them when risks or deficiencies change. This requirement is closely aligned with the ISO 27001 risk assessment and treatment cycle.
Build evidence around:
- information asset and data ownership;
- identity and access management;
- secure configuration and vulnerability management;
- encryption and key management where appropriate;
- backup, recovery, logging, and monitoring;
- physical and environmental security;
- secure development and change control;
- human resource screening, awareness, and disciplinary processes;
- supplier security and cloud governance;
- incident response and lessons learned; and
- business continuity and recovery testing.
ISO/IEC 27001:2022 Annex A provides a reference set of controls, not a list that every organisation implements unchanged. Select controls through risk treatment, document them in the Statement of Applicability, and justify inclusions and exclusions. ISO 27001 implementation guidance can help connect the clauses, risks, and evidence.
Control operators and third parties
POPIA requires an operator to process personal information only with the responsible party’s knowledge or authorisation and to treat it as confidential. Section 21 requires a written contract that obliges the operator to establish and maintain applicable security measures.
Complete due diligence before appointment, include security and privacy clauses, approve subprocessors, control access, define incident notification, and retain audit rights. Monitor performance rather than filing the contract and forgetting it. ISO 27001 supplier controls and operational monitoring provide a useful structure, but contract content must still meet South African legal requirements.
Prepare for security compromises
Create one response process that joins cyber incident handling, POPIA assessment, legal privilege, evidence preservation, communications, and business recovery. Under section 22, the responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible after discovering reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, subject to limited delay grounds.
Define who decides whether the threshold is met, who contacts the operator, what facts are captured, how notices are approved, and how affected people receive practical protective advice. Test the process through exercises. A security plan that stops technical containment is incomplete.
POPIA compliance checklist for ongoing assurance
Check that your organisation can demonstrate:
- accountable privacy and ISMS governance;
- a current processing and information asset inventory;
- approved purposes, notices, and processing justifications;
- data quality, retention, deletion, and data subject request controls;
- a repeatable information security risk assessment;
- an approved risk treatment plan and Statement of Applicability;
- operator contracts, due diligence, and monitoring;
- tested incident and notification procedures;
- role-based awareness and specialist competence;
- internal audits, control testing, management review, and corrective action.
For organisations with mature privacy needs, ISO/IEC 27701:2025 adds requirements and guidance for a privacy information management system and can operate independently or align with ISO 27001. It strengthens structure, but it still does not replace legal interpretation.
Build evidence, not false assurance
ISO 27001 certification can demonstrate that an independently audited ISMS meets the standard’s requirements within its stated scope. It cannot guarantee that every act of processing complies with POPIA. Check the certificate scope, unresolved risks, excluded systems, and legal controls before making claims.
WWISE can help organisations integrate privacy requirements with information security risks, supplier controls, internal audits, and improvements. The objective is not a badge. It is defensible evidence that people, processes, and technology protect personal information throughout its life cycle.
