POPIA sounds like a job for consultants with expensive hourly rates. Most of it is housekeeping you can finish this month.
The fine is real
If you run a South African business and touch personal information, which almost every business does, POPIA applies to you. And the regulator has proven it is willing to act: administrative fines go up to R10 million, and executives can be held personally liable. So this is no longer a paperwork exercise you keep in a drawer.
What you actually have to do
Strip away the legal language and the core duty is simple: know what personal data you hold, why you hold it, who can access it, and how it is protected. For a small business that means one honest afternoon spent listing what you keep, and it is usually more than you think: client details, staff records, maybe a WhatsApp thread with ID numbers in it that should not be there. Then four things are non-negotiable: consent, breach notification to the Information Regulator and the affected customers, and a registered Information Officer, which is a 20 minute conversation with your lawyer.
The infrastructure half
The rest is infrastructure, and this one you can buy instead of build. Hosting local to South Africa, access controls, encrypted backups, audit trails. When a regulator asks what happened to whose data and when, you want a log that answers, not a shrug.
If you want a hand getting your infrastructure POPIA-ready, talk to us at Olorun Cloud.