Activity

No

Activity

No

Create Summary 0 – Documentation

Management

00.0_Summary Category

0_00_Documentation Management

Create Summary POPIA Compliance

Management Framework

00.1_Summary POPIA Compliance

Management Framework

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(a)

Create a Document Retention and

Destruction Policy

Create a Personal Information Assets

Information Classification Matrix and

Handling Guide

00.3_Personal Information Assets

Information Classification Matrix and

Handling Guide

Create an Archiving of Records Register

[To keep record of documents in archive]

Develop & Implement a  Register of

Processing Documentation

00.7_Section 17 Register of Processing

Documentation

Activity

No

Create Summary 1 – Preparation for the

Project 

01.0_Summary Category 01.0 –

Preparation for the Project

01.2_POPI Security Risk Assessment –

Companies

POPIA:  Section 8, 19 & 109(3)(g)

Regulation: R. 4(1)(d)

POPIA:  Section 8

Regulation: R. 4(1)(e)

Draw up a cover letter for Staff Members

Knowledge Questionnaire

01.5_Project Cover letter for Staff

Members Knowledge

Questionnaire

POPIA:  Section 8

Regulation: R. 4(1)(e)

Draw up a cover letter for Leadership 

Knowledge Questionnaire

01.6_Project Cover letter for

Leadership  Knowledge

Questionnaire

POPIA:  Section 8

Regulation: R. 4(1)(e)

01.7_Project Start Questionnaire Staff

Members Knowledge

POPIA:  Section 8

Regulation: R. 4(1)(e)

01.8_Project Start Questionnaire

Leadership Knowledge Questions

POPIA:  Section 8

Regulation: R. 4(1)(e)

01.9_Determining the Data Protection

Designation of the Organisation

12.1.2_Checklist_Staff Awareness Training

12.2.2_Guideline Are you a Responsible Party or an Operator

Activity

No

02_Implement & Maintain Governance &

Leadership Structure

02_Implement & Maintain

Governance & Leadership Structure

02.1_Personal Information Protection

Policy

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Draw up an appointment letter for the

Information Officer

02.2_Appointment Letter Information

Officer

POPIA:  Section 55(1), 55(2)

PAIA: Section 17, 90(1), 90(2),

90(3) & 77K

POPIA Regulation: R. 4

02.3_Authorisation Letter Information

Officer

POPIA:  Section 55(1), 55(2)

PAIA: Section 17, 90(1), 90(2),

90(3) & 77K

POPIA Regulation: R. 4

Draw up an appointment letter for the

Deputy Information Officer

02.4_Designation Letter Deputy

Information Officer

POPIA:  Section 55(1), 55(2)

PAIA: Section 17, 90(1), 90(2),

90(3) & 77K

POPIA Regulation: R. 4

02.5_Access and Confidentiality

Agreement with Employees

Develop Letter to Employees Privacy

Notification

02.6_Letter to Employees Privacy

Notification

POPIA:  Section 18

Develop POPIA Section 18 Privacy

Notification – Employees

02.7_POPIA Section 18 Privacy

Notification – Employees

POPIA:  Section 18

02.8_Template Data Protection Impact

Assessment.asd

POPIA: Sections 8, 19 & 19(3)(g)

Regulation: R. 4(1)(a)

12.1.4_Checklist Section 17 – Documentation of processing operations

12.2.4_Guideline Documentation Processing Operations

Activity

No

03.0_Summary 03_Data Subject Rights

Policies & Procedure

Create Procedure for Handling of Individual

Rights

03.1_Procedure for Handling of

Individual Rights

POPIA:  Section 5 & 109(3)(g) 

Regulations: Regulation 4(1)(d)

Create Consent for Processing of Personal

Information

03.2_Consent to Process Personal

Information Policy

POPIA:  Section 14(7) 

Regulations: Regulation 4(1)(d)

03.3_POPI Section 18 Privacy

Notification – Clients

POPIA:  Section 14(7) 

Regulations: Regulation 4(1)(d)  

03.7_Form 1 Objection to the

Processing of Personal

Information

POPIA:  Section 11(3)

Regulations: Regulation 2

Create Forms and Procedure Request for

Correction or Deletion of Personal

Information or Destroying or Deletion of

Record of Personal Information

POPIA:  Section 24(1)

Regulations: Regulation 3

Create Forms and Procedure Request for

Access to Record of Private Body

03.9_Form C Request for Access to

Record of Private Body

PAIA:  Section 51(1)(b)(iv) & 51(1)(e)

Regulations: Regulation 10

03.10

12.1.5_Checklist Data Subject Rights Forms & Procedures

12.2.5_Guideline Data Subject Rights

Activity

No

Create & Maintain Personal Information

Assets Hardware

04.2_Personal Information Assets

Hardware

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Create & Maintain Personal Information

Assets Shared Databases

04.3_Personal Information Assets

Shared Databases

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Create & Maintain Personal Information

Assets Operating Systems and Software

04.4_Personal Information Assets

Operating Systems and Software

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Activity

No

05.0_Summary Create & Maintain Policies

& Procedures

Create & Implement Information Quality

Policy

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Create & Implement Minimum Access

Policy

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Create & Implement Password

Management Policy

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

05.4_ Acceptable Use Policy of

Computer Equipment

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Create & Implement Bring your Own

Device Policy

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Create & Implement Clear Desk and Clear

Screen Policy

05.7_Clear Desk and Clear Screen

Policy

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Create & Implement Removable Media

Policy

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Activity

No

06.0_Summary Implement & Maintain

Training & Awareness Program

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPIA:  Section 8

Regulations: R. 4(1)(e)

Awareness Poster – Insider, Accidental or

Intentional Data Loss

POPIA:  Section 8

Regulations: R. 4(1)(e)

Awareness Poster – Loss or Theft of

Equipment and Data

Awareness Poster – Loss or Theft of

Equipment and Data

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPIA:  Section 8

Regulations: R. 4(1)(e)

Awareness Poster – What is our client’s

(data subject) rights

Awareness Poster – What is our client’s

(data subject) rights

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPIA:  Section 8

Regulations: R. 4(1)(e)

Awareness Poster – What is Personal

Information

Awareness Poster – What is Personal

Information

POPIA:  Section 8

Regulations: R. 4(1)(e)

Awareness Poster – What to do when

Using a Mobile Device

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPI Act Compliance Awareness

Poster

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPI Awareness1_An Overview

Leadership

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPI Awareness2_An Overview All

Staff

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPI Awareness3_Mobile Devices All

Staff

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPI Awareness5_Collection of Personal

Information in the Context of POPI – All

Staff

POPI Awareness5_Collection of

Personal Information in the Context of

POPI – All Staff

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPI Awareness6_Data Subject Rights – All

Staff

POPI Awareness6_Data Subject Rights

– All Staff

POPIA:  Section 8

Regulations: R. 4(1)(e)

POPI Awareness7_Electronic

Communications – All Staff

POPI Awareness7_Electronic

Communications – All Staff

POPIA:  Section 8

Regulations: R. 4(1)(e)

Activity

No

07.0_Summary Manage Information

Security Risk during Communication and

Transmission

Create & implement Consent to Use

Electronic Communication

07.2_Consent to Use Electronic

Communication

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Create & implement Fax Cover Letter

Confidentiality Notice and Disclaimer

07.3_Fax Cover Letter Confidentiality

Notice and Disclaimer

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

07.4_Disclaimer Clauses for all

Electronic Communications

POPIA:  Section 8 & 109(3)(g) 

Regulations: R. 4(1)(d)

Activity

No

08.0_Summary Managing Third Party

Compliance

Create and maintain an Approved

Vendors_Operator’s list

POPIA:  Section 20, 21 & 22 

Regulations: R. 4(1)(d)

Create and prepare a Cover Letter to send with Operator POPI Compliance

Questionnaire

08.2_Cover Letter Operator POPI

Compliance Questionnaire

POPIA:  Section 20, 21 & 22 

Regulations: R. 4(1)(d)

Create and prepare an Operator POPI

Compliance Questionnaire

08.3_Operator POPI Compliance

Questionnaire

POPIA:  Section 20, 21 & 22 

Regulations: R. 4(1)(d)

Check all third-party service provider agreements and if necessary implement this 08.5_ Data Protection Agreement for

Operators

08.5_ Data Protection Agreement for

Operators

POPIA:  Section 20, 21 & 22 

Regulations: R. 4(1)(d)

Activity

No

Create and maintain Application  for the

Consent of a  Data Subject for the

Processing of Personal Information

09.1_ Application  for the Consent of a

Data Subject for the Processing of

Personal Information

POPIA:  Section 69(2) 

Regulations: Regulation 6

Activity

No

10.0_Summary Implement & Maintain

Security Incident Procedures

Create and maintain Data Breach Policy

Security Compromise Policy

10.1_Data Breach Policy Security

Compromise Policy

POPIA:  Section 8

Regulations: R. 4(1)(e)

Create and prepare 10.2_Data Breach

Security Compromise Report Form

10.2_Data Breach Security

Compromise Report Form

POPIA:  Section 8

Regulations: R. 4(1)(e)