POPIA Policy Template: What You Need and Where to Start

Introduction: Why You Need a POPIA Policy

If your business or organisation handles personal information in South Africa, you are legally required to comply with the Protection of Personal Information Act (POPIA).
A key part of that compliance? Having clear, written policies and manuals. Does your business have a POPIA Policy?

But where do you start? What should your policy include? And can you use a POPIA policy template to make it easier?

Let’s break it down in simple terms.

What Is a POPIA Policy?

A POPIA Policy (also sometimes referred to as a Data Protection Policy or even Privacy Policy) sets out how your organisation collects, uses, stores, and protects personal information.

It tells your customers, staff, suppliers, and even your own team:

• What personal data you collect
• Why you collect it
• How you use it
• Who you share it with
• What rights data subjects have
• What steps you take to keep data secure

Is a POPIA Policy Legally Required?

Section 18 of POPIA requires that every responsible party provides "notification of the collection of personal information", and a written policy is the good way to meet that duty.

Additionally, your Information Officer is responsible for ensuring that policies and procedures are in place (Section 55(1)(a)).

If you don’t have the necessary policies - or if it’s vague, outdated, or copied from a different country - your organisation is at risk.

Who Needs a POPIA Policy?

If you run any of the following, you likely need a POPIA policy:

• Small, medium and large businesses (even sole proprietors, consultants and freelancers)
• Medical or legal practices
• Schools, NGOs, and churches
• Body corporates and HOAs
• Online stores and service providers

What Should a POPIA Policy Template Include?

A good POPIA policy template should include:

1. Introduction and Purpose

State your commitment to privacy and the purpose of the policy.

2. Definitions

Key POPIA terms like "data subject", "responsible party", "personal information", etc.

3. Scope

Who and what the policy applies to (e.g. employees, customers, vendors, digital platforms).

4. Types of Personal Information Collected

Describe what you collect: names, ID numbers, emails, medical info, etc.

5. How and Why Information Is Collected

Explain collection methods (e.g. forms, websites, CCTV) and purposes (e.g. billing, HR, compliance).

6. Data Subject Rights

Access, correction, objection, deletion, and complaint rights under POPIA. 

7. Data Security Measures

Outline how you protect personal data (e.g. passwords, firewalls, locked cabinets, access control).

8. Third-Party Sharing

Who you share data with and under what safeguards (e.g. payroll, IT support, cloud providers).

9. Information Officer Contact Details

If there's a Deputy Information Officer, also their contact details.

Why a South African Template Matters

Many online “privacy policy generators” are based on US or EU laws. These don’t meet South Africa’s POPIA requirements, and using them can be risky.

At POPI Academy, our templates are:

• Written by South African lawyers
• Tailored for local laws and terminology
• Easy to edit and apply
• Suitable for a wide range of industries

Download a POPIA Policy Template

You don’t have to start from scratch.

👉 Download our POPIA Toolkit to get the editable templates you need.

Final Thoughts

When implementing a POPIA policy template, make sure it's locally written, legally sound, and tailored to your needs. 

Protecting your clients' and employees’ data isn't just about avoiding fines, it’s about trust, professionalism, and doing the right thing.

Need one-on-one help?
Ask about our done-with-you service, where a POPIA consultant works with you directly.