The complete document distribution and attestation solution for any business.

Play Video
Click to see how it works

Our Policy Passport

How can Compliance Online help you?

A SIMPLE AND COST-EFFECTIVE CLOUD-BASED SOLUTION TO MANAGE
COMPLIANCE RISKS IN YOUR BUSINESS.

Convinced yet? Schedule your demo session today.

How does Policy Passport pricing work?

A ONCE-OFF SET-UP FEE + A MONTHLY SUBSCRIPTION PLAN + A MONTHLY SUPPORT PACKAGE.

Who chose Policy Passport?

HERE ARE A FEW OF OUR HAPPY CLIENTS.

Frequently asked questions

Here is a list of popular questions about Policy Passport. Contact us to enquire.

Do you need to track employee interaction with important documents?

Policy Passport lets you track whether employees have received access to a document and how they interact with it.
You can track whether employees have:
• read a document
• completed a test on the content of the document
• electronically acknowledged that they have read and understood the document
• provided feedback on the document
Do you know whether your employees understand your documents?


With Policy Passport, you can create open-book multiple-choice tests with feedback which allows you to refer employees to the documents to find the answers.

Employees must get 100% to pass the test and complete the task.
Do you know whether your policies mitigate your risks?

Policy Passport helps you analyse the weaknesses in your policies or company documents.

Policy Passport provides detailed feedback on the test results and indicates which questions were answered incorrectly, how often, and by whom. This allows you to determine who in the organisation struggled to understand your policy and may need further communication or training to mitigate the risks relevant to the policy.
Do you need feedback on your policies?




Policy Passport supports a survey feature to get detailed feedback on assigned policies from your target audience.
Do you need reports?

Policy Passport has the following reporting features:

● Individual employee results
● Overall document completion statuses
● Departmental or business unit level reports
● Reports that are shareable with stakeholders
● Customised reports using filters
● View live reports any time or download them in Excel format
What media/document types do we support?




Policy Passport supports PDF documents, videos, links, and text.

Gallery

What can you expect

Get in touch

HAVE ANY QUESTIONS? REACH OUT TO US FROM OUR CONTACT FORM AND WE WILL GET BACK TO YOU SHORTLY.

Address

88 Main Road, Vrykyk, Paarl
Western Cape, South Africa, 7646

The Protection of Personal Information Act or POPIA is South Africa’s data privacy law. It sets the rules for how companies gather, use, and share people’s private information. POPIA aims to protect folks’ right to privacy and build trust in the digital world.

For businesses in South Africa, following POPIA is key. It helps avoid getting fined, keeps customers’ trust, and gives companies a competitive edge. 

The Protection of Personal Information Act, or POPIA, is South Africa’s data privacy law. It sets the rules for how companies gather, use, and share people’s personal information. POPIA protects the right to privacy and builds trust in the digital world. 

Companies in South Africa must comply with POPIA. Compliance means that companies keep their customers’ trust, it gives them a competitive edge, and helps them to avoid fines. 

POPIA has eight core rules: responsibility, limiting how info is used, specifying why it’s used, limiting further use, high-quality info, openness, security, and involving people the info is about. Companies must follow these and meet needs like: getting consent, having lawful reasons to use the info, only gathering necessary info, securing info, giving people access to their info, etc.

POPIA has these eight core rules: Accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. 

These rules govern things like getting consent, gathering and using  personal information, securing personal information, and giving people access to their personal information – and much more.

POPIA uses a broad definition of personal information. It refers to any information that can be used to identify someone alive or an existing group. This includes things like: names, contact details, ID numbers, email addresses, biometric data, IP addresses, and even guesses made from other information.

Extra sensitive personal information like religious beliefs, race, political views also gets special protection under POPIA. 

Personal information refers to any information that can be used to identify a living person or an existing business. This includes things like: names, contact details, ID numbers, email addresses, biometric data, IP addresses, and even deductions made from other information. 

Extra sensitive personal information, called special personal information, gets special protection under POPIA. Examples include religious beliefs, race, and political views.

Book A Demo

POPIA gives the Information Regulator significant enforcement powers including: conducting audits, issuing compliance notices, imposing large administrative fines, pursuing criminal prosecution, taking civil action in courts, banning non-compliant processing activities, and publicising enforcement actions. Consequences can include punishment under the law, damages, and reputational harm.  

 

POPIA gives the Information Regulator powers to:

  • assess the conduct of companies 
  • to investigate the conduct of companies, and 
  • to punish the conduct of companies.

Non-compliance with POPIA can lead to: Regulatory fines of up to R10 million. 

  • Claims for damages.
  • Reputational damage and loss of customer trust and loyalty. 
  • Imprisonment or fines for individuals.
  • Disruptions to company operations.

To develop a POPIA compliance program, companies should: get executive support, appoint dedicated compliance leads, do a privacy maturity assessment, establish a governance committee, map personal information flows to understand processing activities, enhance the incident response plan, review and update policies and notices, train staff, implement additional safeguards where needed, establish monitoring mechanisms, develop guidelines for impact assessments, have procedures to keep the program up to date, consider regulator certification and maintain records demonstrating implementation.

To develop and implement an effective POPIA compliance programme, companies should:

  • Demonstrate commitment to POPIA compliance.
  • Do a risk-assessment.
  • Put policies and procedures in place.
  • Train their employees.
  • Monitor and report on their POPIA responsibilities.
  • Evaluate and improve their compliance programme.

To conduct privacy impact assessments, companies should: identify the need for an assessment, determine the scope, describe the personal information and sensitivities involved, identify risks and gaps in controls, assess risks and impacts against POPIA’s requirements, consult stakeholders, develop recommendations to address risks, create implementation plans, do periodic reviews and updates, provide oversight and approval, and keep records of assessments. 

A risk assessment must be done for every processing activity and involve these steps:

  1. Identify the activity that must comply with POPIA
  2. Determine who in a company is involved in the activity
  3. Determine who is responsible for following the POPIA rules 
  4. Assess the difficulty of enforcing compliance
  5. Rate the risk

For data breaches, companies must: notify regulators promptly about serious breaches, provide details of breaches to regulators, notify affected individuals directly in high-risk cases, give recommendations to mitigate harm for notified individuals, keep internal records of all breaches that occur, consider voluntarily reporting less-serious breaches to build trust, review when regulators and individuals should be notified based on severity and risks, look for signs that encrypted information may have been accessed and report such cases to regulators, and notify regulators where needed for transparency.

POPIA requires that a company notifies

  • the Information Regulator of a security breach as soon as possible, and
  • the person/s whose personal information has/have been compromised as soon as possible.

Take note that a company may delay notification under certain circumstances. Once it is ready to notify the regulator, it MUST use the form provided on the Information Regulator’s website.

For direct marketing, companies must: obtain explicit consent for marketing purposes, provide easy opt-out methods, register opt-outs to avoid contacting people again, only use information for purposes that match what consent was given for, be careful not to overstep with contact frequency, exercise caution when marketing to vulnerable groups, screen purchased marketing lists against opt-out registers, keep records demonstrating consent and opt-outs, stay up-to-date with laws like anti-spam legislation, only gather and keep information necessary for marketing activities and properly secure such information.

POPIA applies to direct electronic marketing activities and all the POPIA rules apply to the processing of personal information for the purpose of direct electronic marketing. 

Explicit, voluntary and informed consent must be given, and companies have to ensure that:

  •  A record of consent given and withdrawn is kept.
  • The purpose and nature of the marketing does not differ from the type of consent given.

Companies should avoid contacting people too frequently.

For retaining information, companies must: only keep personal information as long as necessary for the original purpose, define clear retention periods in policies, regularly review and update retention schedules, get consent for retaining information indefinitely, have secure procedures in place to delete information that’s no longer needed, keep records of information destruction, consider placing time limits on consent and see if information can be anonymized for longer retention. 

A company should consider the following for data retention:

  • May it retain or archive personal information in terms of POPIA?
  • When it comes to legally archiving personal information, it must have established triggers and procedures for doing so.
  • When information is retained or archived, it must be done correctly and securely.

A company should consider the following for data destruciton:

  • It must not destroy personal information that it must retain.
  • It must destroy personal information correctly – this means it must be done so that the information can’t be reconstructed in an intelligible way.
  • It must destroy the information in a secure manner.

Data protection officers and compliance leads must: advise the business on privacy compliance, monitor compliance and conduct audits, handle people’s requests to access or correct their personal information, act as a contact point for regulators, help train staff, review the privacy impacts of new initiatives, deal with complaints and data breaches, investigate issues and recommend solutions, and stay up-to-date with regulations, risks and best practices.

To properly handle access requests, companies should: designate a contact point for requests, verify individuals’ identities before providing any information, respond within 30 days where possible or communicate timelines for more complex requests, provide information in a format that’s easy to understand, only charge fees for excessive requests, grant requests unless there are lawful grounds for refusal, log and document all requests received, balance access rights with confidentiality by redacting sensitive information where needed, seek guidance for tricky requests and provide the specific access rights afforded to individuals under POPIA.

To transfer personal information overseas, companies must ensure there are similar privacy safeguards in place for the destination countries or put binding agreements in place, obtain explicit consent from the people involved for transferring their information abroad, only transfer information for the purpose stated when obtaining consent and keep records of all cross-border data transfers. 

Extra rules apply for transferring sensitive information and children’s personal information across borders.

POPIA only allows for the transfer of personal information outside of South Africa if the other country has adequate legal protection for personal information, or there are binding corporate rules or a binding agreement that provides the right protection.

It can also be transferred if the data subject consents to the transfer, or the transfer is necessary to fulfil a contract.

To get proper consent, companies must: clearly explain why the information is needed and what it will be used for, inform people of their rights under POPIA, get an obvious confirmation that consent is given through a positive action like ticking a box, allow people to withdraw consent at any time, keep records to prove consent was given, get explicit consent for collecting and using sensitive information and get fresh consent if the purpose for using someone’s information changes significantly. 

Consent must be clearly stated, voluntary, specific and informed. It means that requests for consent must be in plain language, the person must understand what they are giving consent to, and the consent must be actively given (such as ticking a box). 

[Keep in mind that companies should allow people to withdraw their consent at any time, and that fresh consent must be obtained if the purpose of the collection of personal information has changed.(maybe remove, over info?)]

Unlawfully accessing or disclosing someone’s personal information can lead to: legal penalties, lawsuits, criminal charges, business disruptions, damage to reputation, loss of trade secrets and intellectual property. The consequences depend on how sensitive the information is, how many people are affected and whether it was due to negligence or deliberate wrongdoing. 

If the rules of POPIA are not followed, companies may face:

  • Regulatory fines of up to R10 million. 
  • Claims for damages.
  • Reputational damage and loss of customer trust and loyalty. 
  • Disruptions to company operations.
  • Imprisonment or fines for individuals.

Companies must: appoint dedicated compliance leads, obtain proper consent from customers when required, have valid and lawful reasons for collecting and using personal information, gather information directly from the people concerned where possible, only retain personal information as long as necessary for the original purpose, keep personal information secure, allow people access to their information and enable corrections upon request, properly train staff, conduct impact assessments for high-risk information processing activities, report serious data breaches to regulators and maintain records to demonstrate compliance with POPIA.

  •  Ensure that there are good reasons for using personal information, and get consent when the law requires it.
  • Only keep personal information if it is required, and give people access to their information if they request it.
  • Put good security controls in place and do comprehensive impact assessments for high-risk processing activities. 
  • Report serious data breaches to the regulators in the right way.

Under POPIA, individuals have rights to be notified about the collection of their personal information, ask for access to and corrections of their data, object to processing and direct marketing, make complaints to regulators, and be notified about serious data breaches. Companies must enable individuals to exercise their rights.

Under POPIA, individuals have the right to 

  • be notified about the collection of their personal information,
  • ask for access to and corrections of their personal information, 
  • object to the processing of their personal information, and 
  • make complaints to regulators, and be notified about serious data breaches. 

Companies must not prevent individuals from exercising their rights.

To protect personal information, companies should classify data sensitivity, encrypt sensitive data, control access, train employees, audit controls, install security tools like firewalls and anti-malware, set strong password policies, back up data, monitor systems, develop incident plans, and stay up-to-date with threats and best practices.

Companies should take reasonable technical and organisational steps to secure personal information. Companies should:

  • Identify internal and external risks to processing personal information.
  •  Establish and implement appropriate measures to protect against these risks (think about encryption of sensitive data, access control, the installation of security tools like firewalls and anti-malware, and backing up important information).
  • Regularly review and update protective measures and train staff on them.
  • Stay up to date with the latest security threats and best practices.
Get In Touch

To comply with POPIA, companies should: appoint dedicated compliance leads, figure out how information flows through the business, review policies, get proper consent from customers, have valid reasons for using people’s information, put good security controls in place, give people access to their information upon request, only keep information as long as necessary, properly train staff, regularly check compliance and do comprehensive impact assessments for high-risk information processing activities. Following POPIA is an ongoing responsibility and requires real commitment to privacy governance. 

Companies can ensure compliance with POPIA by following these steps:

  • Appoint an information officer and register them with the Information Regulator. 
  • Determine how information flows through the company.  
  •  Review company policies on data protection, or develop policies if they are not available. 
  • Ensure that there are valid reasons for using personal information, and get consent when the law requires it.
  •  Only keep personal information if it is required, and give people access to their information if they request it.
  • Put good security controls in place and do comprehensive impact assessments for high-risk processing activities. 
  • Ensure that staff is trained, and regularly check compliance with POPIA.

Remember that compliance is an ongoing responsibility and requires a commitment to good privacy governance.

Not complying with POPIA can have serious consequences like:

  • Regulatory fines up to R10 million. 
  • Lawsuits and claims for damages from people whose info was misused.
  • Reputation damage and losing customer trust and loyalty. 
  • Business disruptions from enforcement actions. 
  • Missing opportunities to innovate using personal information.  
  • Competitive disadvantage compared to compliant companies.

Not complying with POPIA can have serious consequences for guilty parties, such as:

  • Regulatory fines of up to R10 million. 
  • Claims for damages.
  • Reputational damage and loss of customer trust and loyalty. 
  • Imprisonment or fines for individuals.
  • Disruptions to company operations.
Download Programme Brochure

We offer bespoke pricing for all clients. We offer bulk ‘slot’ packages, where companies can purchase a bundle of slots upfront to distribute across our training programmes over a 12-month period.

The more slots purchased, the larger the discount. This allows organisations to train as many employees as needed on essential compliance and skills development topics at a competitive rate.

Contact us for a free consultation and custom pricing proposal based on your organisation’s requirements.

POPIA establishes guidelines for processing personal information. This programme offers an overview of the rules your employees must follow. On completion, trainees will understand:

* The relevance of POPIA and who must comply   

* The definition of “personal information” 

* When information is “processed” under POPIA  

* The rules for properly processing information

* Practical steps to ensure POPIA compliance

* Consequences of non-compliance   

POPIA sets conditions for processing personal information. This programme explains POPIA’s rationale and aims. With POPIA now law, train your employees on proper processing of personal information.  

Given POPIA covers employee and client information, breaches can impact your business. This programme demystifies “personal information” and explains when/how employees must comply