What you get
The documents, and the evidence behind them
Two documents that satisfy specific sections of two Acts, a banner that enforces what the documents promise, and a record that proves it happened.
PAIA · Section 51
Your PAIA manual
The manual is how a member of the public finds out what records your business holds and how to ask for one. Section 51 says every private body must have it. There is no turnover threshold and no exemption for being small.
Yours is written from your answers, not left as a template with square brackets in it — which is the state most downloaded manuals are still in when the Regulator asks to see one.
- Contact details and Information OfficerNamed, with the postal and physical addresses a request can actually be delivered to.
- The records you hold, by categoryGrouped as the Act expects, from the answers you gave about your own operation.
- How to make a request, and what it costsThe procedure, the prescribed fees, and the grounds on which a request may be refused.
- Annexure AThe particulars regulation 7 requires, with a pointer to the Regulator's own published form rather than a copy of it that could go stale.
- Current Regulator detailsChecked against the Regulator directly, and re-checked at every release. Their address has already changed once since POPIA commenced.
- What you collect and whyPurpose stated per category, which is what section 13 requires and what most policies skip.
- How long you keep itRetention periods per category. Section 14 does not accept "as long as necessary" on its own.
- Who else sees itYour operators and recipients, and whether any of them are outside South Africa — which is where section 72 starts to matter.
- The rights people haveAccess, correction, objection and withdrawal, each with the route to exercise it.
- A real cookie tableThe tracking your site actually uses, disclosed by category and matched to the banner.
POPIA
Your privacy policy
The document that tells people what you do with their information. It is the one a customer reads, a client's auditor checks, and the Regulator asks for first.
It also has to agree with your website. A policy promising that analytics only runs with permission, on a site that loads analytics regardless, is worse than no policy at all — it is a written record of the gap.
The consent record
The part nobody asks about until the day it is the only thing that matters.
Sealed in sequence
Each entry is sealed against the one before it. Alter, insert or remove a record afterwards and the sequence stops agreeing with itself — which the portal reports in one click.
Pseudonymised
Addresses and browser fingerprints are stored as salted one-way digests. The log proves what was consented to without becoming a fresh pile of personal information you now have to defend.
Yours to take
Export the whole log as a spreadsheet whenever you like. It is your evidence of lawful processing, and it leaves with you if you leave.
Why this is the part that matters
A complaint is not answered by saying you had a banner. It is answered by producing what a particular person chose, on a particular day, against a particular version of your policy — in a form that could not quietly have been written after the complaint arrived.
See what yours would say
Answer the questionnaire and both documents are generated from your own details in about a minute. R800 a month, the founding rate for the first 25 clients.