Free Training & Career Tips... Subscribe to Get Weekly Career Tips
By Subscribing You are Agreeing to Terms and Conditions
POPIA Act training teaches your staff how to collect, use, store, share and delete personal information lawfully under the Protection of Personal Information Act, and what to do when something goes wrong. BOTI runs it as a 2-day course for teams and as a 3-hour online masterclass for every employee, delivered in-house, at our Johannesburg venue or live online. You can compare it with our other risk, governance and compliance training courses.
Courses on this topic at BOTI today
- POPIA Basic Training – Protection of Personal Information Act (2 days)
- POPIA for Every Employee: Handling Personal Information Safely (3-hour online masterclass)
At your offices anywhere in South Africa, live online or at a BOTI venue.
See all Strategy, Risk, Governance and Compliance coursesGet a quote for your teamLearning on your own? Self-paced e-learning from R595 (excl. VAT) · Ask your employer to pay
Most POPIA breaches are not malicious. They happen because an untrained employee forwards the wrong spreadsheet, keeps records too long, or does not recognise a data subject request. Training means the people who answer emails, take customer calls, run payroll and manage files know what the Act requires of them, and your organisation carries less avoidable compliance risk.
This article is for HR and L&D leads, compliance and risk managers, and business owners who have appointed an Information Officer but have not yet trained the staff who handle personal data every day. It covers:
- what POPIA training teaches;
- who must attend;
- how the training is delivered;
- how the spend fits into your skills development planning.
The business problem: your policy is compliant, your people are not
Most South African organisations have done the paperwork. They have a POPIA policy in a folder, an Information Officer registered with the Information Regulator and a privacy notice on the website. What is usually missing is the part that prevents actual breaches: staff who understand the eight conditions for lawful processing and apply them in their daily work.
That gap is where the real exposure sits. POPIA non-compliance is not abstract. The Act provides for administrative fines of up to R10 million, and certain offences can carry criminal liability. Long before any penalty, an untrained team causes practical damage:
- Accidental disclosure. An employee emails an unprotected list of customer ID numbers, or replies to all with personal data attached.
- Mishandled requests. A data subject asks what information you hold or asks for it to be deleted, and nobody on the front line recognises this as a formal request with deadlines.
- Over-collection and over-retention. Teams gather more personal information than they need and keep it indefinitely, which breaches the minimality and retention requirements.
- Unreported incidents. Staff hide or ignore a security compromise instead of escalating it, so the organisation misses its duty to notify the Regulator and the people affected.
A policy cannot fix any of that on its own. POPIA training turns the policy into behaviour: your people learn what personal information is, what lawful processing looks like, and exactly what to do when something goes wrong.
Who this POPIA training is for
This is corporate training for organisations getting their own staff compliant, not a qualification for individual job-seekers. POPIA applies to almost everyone who handles personal information, so the audience is broad:
- HR and L&D managers rolling out organisation-wide POPIA awareness as part of compliance and onboarding.
- Compliance, risk and legal teams who need a documented record that staff have been trained.
- Information Officers and their deputies who carry statutory responsibility and need their teams aligned.
- Business owners and MDs of SMEs who must comply but have no in-house compliance function.
- Front-line and back-office teams (sales, customer service, admin, finance, marketing and IT) who collect, store, share or process personal data every day.
No legal background is required. The training is built for ordinary business users, with the depth tailored to each group:
- a broad awareness session for general staff;
- a deeper module for those who manage data, run direct marketing or hold Information Officer duties.
BOTI’s POPIA training options
- POPIA Basic Training – Protection of Personal Information Act (2 days). This is the full course for teams, supervisors and the people who support your Information Officer.
- POPIA for Every Employee: Handling Personal Information Safely (3-hour online masterclass). This is a short, practical awareness session that suits large or spread-out workforces.
What POPIA training covers: outline and modules
The programme is practical and grounded in real workplace scenarios. Staff work through the situations they actually face, not legal theory. A typical outline:
| Module | What your team learns |
|---|---|
| 1. POPIA in plain terms | Why the Act exists, who it applies to, and key definitions: personal information, special personal information, data subject, responsible party, operator. |
| 2. The eight conditions for lawful processing | Accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards and data subject participation, explained with everyday examples. |
| 3. Consent, purpose and minimality | When you need consent, the lawful grounds for processing, and collecting only what you genuinely need. |
| 4. Data subject rights | Recognising and handling access, correction and deletion requests within the required timeframes. |
| 5. Direct marketing and POPIA | The rules for electronic marketing, opt-in and opt-out, and staying compliant in sales and marketing. |
| 6. Security safeguards in practice | Protecting personal information day to day: email, devices, filing, passwords and third-party operators. |
| 7. Breaches and incident response | Spotting a security compromise, escalating it correctly, and the duty to notify the Information Regulator and affected parties. |
| 8. Roles and accountability | The Information Officer’s duties, staff responsibilities, and how POPIA links to PAIA and your internal policies. |
For in-house bookings, the content is tailored to your sector and the personal data your teams actually handle. A medical practice, a call centre and a retailer each leave with very different worked examples.
Want this scoped to your organisation and the data your staff handle? Phone 011 882 8853 or request a quote. You can also ask BOTI to help you put together a short “do and don’t” guide your team can keep at their desks after the training.
Why getting staff trained matters more than the policy
POPIA places the legal duty on the responsible party, which is your organisation. You need to be able to show that you have taken reasonable steps to comply, and documented staff training is one of the clearest pieces of evidence you can offer:
- It shows due diligence. If an incident occurs, a record that staff were trained helps demonstrate accountability, the first condition of the Act.
- It prevents the common breaches. Many incidents are human error. Training the people at the keyboard reduces one of the largest sources of risk.
- It puts the accountability condition into practice. POPIA requires responsible parties to ensure the conditions are met, and awareness training is how that obligation reaches every desk.
- It protects trust and reputation. A single mishandled customer record can cost more in lost confidence than a fine.
For most organisations, the natural foundation is broad POPIA awareness for all staff. Deeper compliance and governance training then follows for the people who carry formal responsibility.
Delivery formats
You choose the format that fits your team and roll-out:
- In-house at your premises. This is usually the most cost-effective option for a group, and the closest fit because the session is built around your own data, systems and policies.
- At BOTI’s venue in Sunningdale, Johannesburg. This suits teams that prefer to train away from daily interruptions.
- Live online, instructor-led. This is efficient for teams spread across several branches, with no travel and full interaction.
Head-office and branch teams can be trained to the same standard. In-house delivery usually becomes more economical once you have several people to train.
Accreditation
BOTI delivers POPIA training as a practical, facilitator-led programme. It is not a qualification, which suits POPIA well: the goal is documented awareness that changes behaviour across whole teams. The attendance register and certificates let you record the training in your Annual Training Report as staff development, and they give you evidence of the steps you have taken.
BOTI is a QCTO-accredited Skills Development Provider. If you also need an accredited, credit-bearing route for administrative staff, ask about the Occupational Certificate: Office Administrator (SAQA ID 102161, NQF Level 5, 445 credits)[1].
Last dates for the Office Administrator qualification: new learners must enrol by 30 December 2026 and complete by 30 December 2029[1]. The qualification ends in an External Integrated Summative Assessment (EISA), and the QCTO issues the certificate.
Funding: it counts as staff development
POPIA training is compliance training, so the spend fits inside your existing skills development planning. As general guidance only:
- Employers pay the Skills Development Levy (SDL) at 1% of the leviable amount (total remuneration). Employers whose leviable amount over the next 12 months will not exceed R500,000 are exempt[2].
- Training delivered to your staff, including POPIA upskilling, can be captured in your Workplace Skills Plan (WSP) and Annual Training Report (ATR).
- The mandatory grant pays back 20% of the levies you paid. To receive it, you must submit the WSP/ATR to your SETA by 30 April and be up to date with levy payments[3].
- Under the amended generic B-BBEE Codes, the skills development target is 6% of the leviable amount, not 6% of payroll. It is made up of 3.5% on learning programmes for black people and 2.5% on bursaries for black students at higher education institutions[4].
- Documented training for black employees may count towards the learning programmes target, subject to verification.
- Sector codes may set different targets.
This is general information, not legal or financial advice. Confirm the specifics with your SETA, Skills Development Facilitator, Information Officer or B-BBEE verification professional. Treat the compliance content as general guidance rather than legal advice on your particular circumstances.
Why BOTI
BOTI is a South African corporate training company and QCTO-accredited Skills Development Provider with 450 courses. Its clients include Sasol, Glencore and the City of Johannesburg. We deliver practical compliance training for whole teams, tailored to the data your people handle and the systems they use. For a duty like POPIA, that practicality is the point. Your team leaves knowing what to do at their desk, and you leave with a documented record that you trained them.
POPIA rarely sits alone. Many clients pair it with related programmes:
- Risk management training, to embed POPIA inside a broader risk and controls framework.
- Cyber Security Awareness Training, for the security safeguards side of POPIA: phishing, passwords and safe handling of devices.
- Corporate governance training, for boards and executives accountable for compliance.
- Human resource management training, where employee personal data and POPIA obligations meet day to day.
- In-house and on-site corporate training, for group delivery with attendance records and certificates.
- The full BOTI course range, covering compliance, management, HR, finance and technical training for teams.
Not sure where to start? Our team can map the right path: broad awareness for all staff, plus deeper modules for your Information Officer and data-handling teams.
Frequently asked questions
What is POPIA Act training?
POPIA Act training is practical compliance training that teaches staff how to handle personal information lawfully under the Protection of Personal Information Act. It covers what personal information is, the eight conditions for lawful processing, consent and minimality, data subject rights, direct marketing rules, security safeguards, and how to recognise and report a breach. The focus is on day-to-day behaviour, so no legal background is needed.
Who is responsible for making sure everyone in the business complies with POPIA?
The Information Officer. By default this is the head of the organisation, such as the CEO or owner, who may appoint deputy information officers to help. The Information Officer encourages compliance, deals with requests and works with the Information Regulator, the independent body that monitors and enforces POPIA. Team leaders and managers remain responsible for how their own teams handle personal information.
Who in our organisation needs POPIA training?
Anyone who collects, stores, shares or processes personal information. In most organisations that is nearly everyone: sales, customer service, admin, finance, marketing, HR and IT, plus managers and the Information Officer. General staff need broad awareness, while people who manage data, run marketing or hold Information Officer duties need a deeper module.
Is POPIA training a legal requirement?
POPIA places the compliance duty on your organisation as the responsible party and requires you to take reasonable steps to meet its conditions, including accountability. The Act does not prescribe a specific course. However, documented staff training is one of the clearest ways to show that you have acted reasonably. This is general guidance, not legal advice.
Can we do POPIA training online?
Yes. BOTI runs POPIA for Every Employee: Handling Personal Information Safely as a 3-hour live online masterclass. The 2-day POPIA Basic Training can be delivered live online, in-house at your premises or at BOTI’s venue in Sunningdale, Johannesburg. For in-house groups, the scenarios are tailored to your sector and the personal data your teams handle.
Request a quote for POPIA training
Turn your POPIA policy into staff who keep you compliant. Book POPIA Basic Training – Protection of Personal Information Act for your team, or request a quote and a BOTI consultant will scope the programme around your team, sector and data. Call BOTI on 011 882 8853 or email [email protected]. Training runs in-house at your premises, at BOTI’s venue in Sunningdale, Johannesburg, or live online. This course is not accredited. It is delivered as a professional skills programme, and delegates receive a BOTI certificate of attendance.
Sources
- SAQA qualification record 102161: Occupational Certificate: Office Administrator – SAQA, 2026.
- Skills Development Levy – South African Revenue Service (SARS), 2026.
- Mandatory Grants – Health and Welfare SETA (HWSETA), 2026.
- Codes of Good Practice on B-BBEE: Code Series 300, Statement 300 – Skills Development (Government Gazette 42496) – Department of Trade and Industry, 31 May 2019.