Home / Non-Accredited / Strategy, Risk, Governance & Compliance / POPIA Basic Training – Protection of Personal Information Act (2 days)
Quick Look Course Summary:POPIA Basic Training – Protection of Personal Information Act (2 days)
-
Length: 2 (s)
-
Price (at your venue): 1 Person R 10,326 EX VAT 3 Person R 7,594 EX VAT 10 Person R 5,537 EX VAT
-
Certification Type:Non-Accredited
-
Locations & Venues:
Get Free & personalised
Training Advice
POPIA Basic Training – Protection of Personal Information Act (2 days)
Know what POPIA requires of your organisation and of your own job – and leave with practical steps to comply.
Every South African organisation that collects personal information about customers, employees or suppliers must comply with the Protection of Personal Information Act (POPIA, Act 4 of 2013). Compliance has been required since 1 July 2021, and the Information Regulator can investigate complaints, issue enforcement notices and impose fines. Yet in many organisations the people who handle personal information every day have never been shown what the Act asks of them. This POPIA training explains the law in plain language and shows what compliance looks like in daily work.
Day one covers the constitutional right to privacy, the key definitions, the roles of responsible parties, operators and data subjects, and the eight conditions for lawful processing. Day two turns to practice: the duties of the information officer, working with the Information Regulator, security safeguards and breach notification, contracts with operators, cross-border transfers, direct marketing and the PAIA manual.
Exercises use your own collection forms, privacy notices and processes, so delegates leave with a short list of fixes for their own area. The course builds awareness and practical compliance skills; it is not legal advice.
Why this course
For your organisation
- Staff who handle personal information lawfully in their daily work
- Information officers and deputies who understand their duties
- Lower risk of security compromises, complaints and enforcement action
- Practical fixes to forms, notices, operator contracts and marketing practices
- A clear starting point for a POPIA compliance framework
For your delegates
- A plain-language understanding of the Act and its key terms
- A checklist for the eight conditions for lawful processing
- Confidence to handle access, correction and objection requests
- A step-by-step response to a data breach
- A personal compliance action plan for your own area
What delegates will be able to do
- Explain the purpose and scope of POPIA and who it applies to
- Distinguish personal information, special personal information and other data
- Apply the eight conditions for lawful processing to everyday work
- Describe the duties of the information officer and the registration requirement with the Information Regulator
- Review a privacy notice and a consent wording for clarity and completeness
- Respond correctly to requests from data subjects for access, correction or objection
- Identify security safeguards and follow the steps for notifying a security compromise
- Control operators, service providers and cross-border transfers through contracts and checks
- Check whether a direct marketing campaign meets the Act's consent rules
- Explain how PAIA links to POPIA and keep the PAIA manual up to date
Who should attend
Information officers and deputy information officers, compliance, legal, HR, IT, marketing and customer-service managers, and anyone responsible for handling personal information or for POPIA compliance in their organisation – in private companies, public bodies, schools, clinics and non-profit organisations.
Course outline
Day 1 – The Act and the conditions for lawful processing
Introduction to privacy and POPIA
- The constitutional right to privacy (section 14 of the Bill of Rights)
- Purpose, scope and commencement of POPIA (Act 4 of 2013)
- Who the Act applies to: public and private bodies
- Exclusions and exemptions in brief
Key concepts and roles
- Personal information versus other data, including information about juristic persons
- Processing, records and the data subject
- Responsible parties and operators
- Special personal information and the personal information of children
The conditions for lawful processing (part 1)
- Accountability
- Processing limitation: lawfulness, minimality, consent, justification and objection
- Purpose specification and retention of records
- Further processing limitation
The conditions for lawful processing (part 2)
- Information quality
- Openness: documenting processing and notifying data subjects
- Security safeguards
- Data subject participation: access to and correction of information
Communicating with data subjects
- Privacy notices that customers and staff can understand
- Obtaining and recording valid consent
- Handling access, correction and objection requests
- Exercise: reviewing a sample collection form and privacy notice
Day 2 – POPIA compliance in practice
Information officers and the Information Regulator
- Duties of the information officer and deputy information officers
- Registering the information officer with the Information Regulator
- Prior authorisation and codes of conduct in brief
- Complaints, investigations, enforcement notices, fines and offences
Security safeguards and security compromises
- Organisational and technical measures to protect personal information
- Identifying and reducing privacy risks
- Notifying the Information Regulator and data subjects of a security compromise
- Case study: responding to a data breach
Operators, service providers and cross-border transfers
- Written contracts and controls over operators
- Cloud services and outsourced processing
- Transborder flows of personal information
- Checklist for third-party processing
Marketing, profiling and other high-risk processing
- Direct marketing by electronic communication: consent and the existing-customer rule
- Cross-marketing, profiling and automated decision-making
- Unstructured data and secondary use of personal information
- Exercise: is this marketing campaign compliant?
PAIA and records management
- The Promotion of Access to Information Act (PAIA, Act 2 of 2000) and its link to POPIA
- Updating the PAIA manual
- Documenting processing operations
- Retaining and destroying records appropriately
Building privacy capability in the organisation
- The personal information impact assessment
- A compliance framework: policies, training and monitoring
- Staff awareness and accountability
- Personal compliance action plan and course evaluation
How it is delivered
Two days, 08:30-16:00. In person at your offices anywhere in South Africa, at a BOTI venue, or live online. One delegate or a group of up to 20; examples tailored to your sector on request. Workbook, POPIA compliance checklist and breach-response template included. We deliver it at your offices in Johannesburg, Pretoria, Durban, Cape Town and anywhere else in South Africa, at a BOTI venue in Johannesburg, or live online for teams in different places.
What our clients say
“All training programmes were delivered in a highly professional manner, with effective coordination and strict adherence to our scheduling requirements. The facilitators demonstrated a commendable level of expertise, and the quality of delivery consistently met our expectations.”
“All training sessions were well-coordinated, professionally delivered, and aligned with our scheduling requirements. We were particularly impressed by the high standard of facilitation and the depth of expertise demonstrated throughout the programmes.”
“All training sessions were well-coordinated, professionally delivered, and aligned with our scheduling requirements. We value the partnership and look forward to continued collaboration with Business Optimization Training Institute in the future.”
Enrol or ask a question
Frequently asked questions
Can you run POPIA training at our offices?
Yes. Most groups are trained at the client's premises anywhere in South Africa; we can also host the course at a BOTI venue or deliver it live online.
How many people can attend?
From one delegate to a group of about 20. The price per delegate drops as the group grows – see the price table, or ask us for a quote.
Is the course accredited?
No. It is a non-accredited short course, and delegates receive a BOTI certificate of attendance.
Can the course be tailored to our sector?
Yes. The facilitator can focus on the processing that matters most to you – for example health information in clinics, children's information in schools, customer data in financial services or direct marketing in retail. Send us your forms and notices beforehand to use in the exercises.
Is this legal advice?
No. The course builds awareness and practical compliance skills. For an opinion on a specific situation, consult an attorney or the guidance published by the Information Regulator.
Can you run this course in Johannesburg, Cape Town or Durban?
Yes. We train on site at your offices in Johannesburg, Pretoria, Durban, Cape Town and across South Africa, at a BOTI venue in Johannesburg, or live online so a team spread over several offices can attend together.
Related courses
Get your price – the more delegates, the less each pays
Change the options to see your price per person, then email yourself the quote and course outline.
Contact us now – we reply within 15 minutes during office hours
Monday to Friday, 08:00–17:00. After hours, we reply on the next working day – or call 011 882 8853.