POPIA: every control, and what you already have

43 controls 132 frameworks share controls with it South Africa verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Bahrain PDPL	6	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	6	measure it →
Privacy Act 1988 (Australia)	6	measure it →
Privacy Act 2020	6	measure it →
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)	6	measure it →
Turkey KVKK	6	measure it →
Vietnam PDPD	6	measure it →
Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014)	5	measure it →
Barbados Data Protection Act 2019	5	measure it →
Singapore Government Instruction Manual on ICT&SS Management (IM8)	5	measure it →
Regulation on the European Health Data Space (EHDS)	5	measure it →
AICPA Privacy Management Framework (PMF)	4	measure it →

Every control

Code	Control	Also in
`POPIASA-1`	Accountability, Processing Limitation, Lawful Basis, Codes	0
`POPIASA-2`	Purpose Specification, Collection Limitation, Further Processing Limitation	0
`POPIASA-3`	Data Subject Rights (Access, Correction, Objection), Automated Decisions	50
`POPIASA-4`	Special Personal Information, Children, Information Quality, Documentation	94
`POPIASA-5`	Security Safeguards, Encryption, Access Control, Operator Obligations	87
`POPIASA-6`	Transborder Information Flows, Direct Marketing	21
`POPIASA-7`	Information Officer, Records of Processing, Notification, Training	42
`POPIASA-8`	Information Regulator Cooperation, Complaints, Enforcement	20
`1-2`	Definitions and purpose	0
`10`	Condition 2, processing limitation: minimality	0
`100-109`	Offences, penalties and administrative fines	0
`11`	Condition 2, processing limitation: consent, justification and objection	0
`110-115`	Regulations, amendment of laws, transitional arrangements and commencement	0
`12`	Condition 2, processing limitation: collection directly from the data subject	0
`13`	Condition 3, purpose specification: collection for a specific purpose	0
`14`	Condition 3, purpose specification: retention, destruction and restriction of records	0
`15`	Condition 4, further processing limitation	0
`16`	Condition 5, information quality	0
`17`	Condition 6, openness: documentation of processing operations	0
`18`	Condition 6, openness: notification to the data subject when collecting	0
`19`	Condition 7, security safeguards: integrity and confidentiality	0
`20`	Condition 7, security safeguards: operators and persons acting under authority	0
`21`	Condition 7, security safeguards: written operator contracts and operator breach notification	0
`22`	Condition 7, security safeguards: notification of security compromises	0
`23`	Condition 8, data subject participation: access to personal information	0
`24`	Condition 8, data subject participation: correction and deletion	0
`25`	Manner of access	0
`26-27`	Special personal information: prohibition and authorisations	0
`3-7`	Application, lawful processing, rights of data subjects and exclusions	0
`34-35`	Personal information of children: prohibition and authorisations	0
`36-38`	Exemptions from the conditions	0
`39-54`	The Information Regulator	0
`55-56`	Information officer and deputy information officers	0
`57-58`	Prior authorisation by the Regulator	0
`60-68`	Codes of conduct	0
`69`	Direct marketing by unsolicited electronic communications	0
`70`	Directories of subscribers	0
`71`	Automated decision making	0
`72`	Transfers of personal information outside the Republic	0
`73-99`	Enforcement: complaints, investigation, assessments, enforcement notices, appeals and civil remedies	0
`8`	Condition 1, accountability: responsible party ensures the conditions are met	0
`9`	Condition 2, processing limitation: lawfulness and reasonableness	0
`REGS`	Regulations relating to the Protection of Personal Information, 2018 (amended 2025), and Regulator guidance	0

Tell me when POPIA files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Retention schedule
Retention schedule with the section 14(1) ground per record class
Destruction and de-identification records showing irreversibility
Restriction procedure and log with pre-lifting notices
Purpose specification
Retention schedule by data category
Data quality procedures proportionate to the purpose
Update and correction workflows
Data inventory mapping each data element to a lawful purpose
Accuracy maintenance and update procedures

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Indefinite retention named by 7 frameworks
No accuracy review of long-held records named by 3 frameworks

What this page is

A control-level reference for POPIA, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition