Policies customised to ensure your Practice’s specific compliance with [BCEA / POPIA and PAIA] are available upon request. To procure these Policies please proceed with the ordering process, and our Compliance Manager will engage with you directly to facilitate further arrangements.

According to the Protection of Personal Information Act 4 of 2013 and the Promotion of Access to Information Act 2 of 2000 all Companies, even Entities without Employees, must comply with these two Legislations.

You must be able to proof and provide evidence of your Compliance.

We build and compile your evidential POPIA & PAIA FILE for you, on your behalf, on your Letterhead.  Step-by-step instructions, guidance and assistance.

We do this remotely. Once Off Fee. Free future notifications and amendments.

What’s Included

• A Compliance Management Framework: this must be developed, implemented, monitored and maintained.
• A PAIA / Information / Section 51 Manual: this manual is mandatory and contains all the information necessary.
• Appointment Letters for the Information Officer and Deputy Information Officer/s: these must be in writing, with full and clear duties, responsibilities and accountabilities.
• Operator Agreements: these must be in place, as all Responsible Parties are responsible for actions taken by their Operators. It is essential to make sure your Operators are compliant as well.
• All Training Material: it is mandatory to conduct regular training with your employees. We also supply Training Rosters, Training Logs, and Tests with Questions and Answers, which makes this requirement much easier to achieve.
• All Relevant Documents, Policies, Forms, Registers, Assessments, Checklists and Guidelines: these are essential to provide evidence of your compliance.

Index of Documents for Your POPIA & PAIA Compliance File

1. Regulator Information – Duties of the Information and Deputy Information Officers
2. Letter to All Staff
3. Information, PAIA, Section 51 Manual
4. Access and Confidentiality Agreement with Employees
5. Briefing POPI Presentation
6. Security Risk Assessment – Micro and Small Healthcare Practices
7. Cover Letter for Staff Knowledge Questionnaire
8. Project Start Questionnaire for Leadership
9. Accountability Framework Self-Assessment
   • 9.1 Determining the Data Protection Designation of the Organisation (Responsible Party, Operator or Joint Controller)
   • 9.2 Register of Processing Documentation (Excel spreadsheet)
   • 9.3 Template: Personal Information Impact Assessment
10. Questionnaire: POPI Act Implementation (editable Word format)
11. Employee Training Program (Session 3)
    • 11.1 · 11.2 · 11.3 · 11.4
12. Appointment Letter: Information Officer
13. Appointment Letter: Deputy Information Officer/s
14. Privacy Notification to Data Subjects – Company Clients/Patients
15. Client/Patient Personal Information (PI) Policy
16. Destruction Certificate
17. Retention and Disposal Policy of Records
18. Handling Guide: PI Assets Information Classification Matrix and Handling Guide
19. Guideline: Information Asset Register Guidance
20. Employee PI Protection Policy
21. Privacy Notification to Staff Members
22. Register of Records for Disposal
23. Register of Records in the Archive
24. Information Asset Register/s
    • 24.1 How to Find Computer Hardware
25. Inventory of Records and Personal Information Bank
26. Personal Information Assets: Hardware
27. Personal Information Assets: Operating Systems and Software
28. Personal Information Assets: Shared Databases
29. Training Webinars 1 to 7, plus Posters
30. Acceptable Use of Computer Equipment Policy
31. Clear Desk and Clear Screen Policy
32. Information Quality Policy
33. Minimum Access Policy
34. Password Management Policy
35. Removable Media Policy
36. Shred-it All Policy
37. Social Media Policy
38. Procedure for Handling Data Subject Requests – Practice Policy
39. Withdrawal of Consent Form
40. Data Subject Request Register
41. Form 02 – Request for Access to Record (Reg. 7) & Form 03 – Outcome of Request and Fees (Reg. 8)
42. RSA Document: Form 2 – Request for Correction or Deletion of Personal Information
43. RSA Document: Form 1 – Objection to the Processing of Personal Information
44. Patient Identification Policy
45. Consent Form – How to Use Electronic Communication
    • 45.1 Consent to Process PI
46. Disclaimer Clauses for All Electronic Communication
47. Fax Cover Letter – Confidentiality Notice and Disclaimer
48. Guideline: Using Electronic Communication – Privacy and Security Matrix
49. Approved Vendors Form
50. Cover Letter: Operator POPI Compliance Questionnaire
51. Operator POPI Compliance Questionnaire
52. Confidentiality Provisions for Operator Agreements
53. Data Breach Policy (Security Compromise Policy)
54. Data Breach Security Compromise Report Form
55. Advice on Cybersecurity for Your Practice (2 documents)
56. Form 4: Request for the Consent of a Data Subject for the Processing of PI for the Purpose of Direct Marketing
    • 56.1 Form 5: Complaint Regarding Interference with the Protection of PI / Complaint Regarding Determination of an Adjudicator
57. Training Headers

Legislation, Regulations & Ethical Guidelines

58. HPCSA

• Booklet 2: Ethical and Professional Rules
• Booklet 3: National Patients’ Rights Charter
• Booklet 5: Confidentiality – Protecting and Providing Information
• Booklet 9: Guidelines on Keeping Patient Records
• Booklet 10: Guideline for the Practice of Telemedicine
• Booklet 16: Guidelines on Social Media

59. Information Regulator

• InfoRegSA Covid-19 Guidance Notes
• InfoRegSA Guidelines: Develop Code of Conduct
• InfoRegSA Prior Authorisation Guidance Notes
• InfoRegSA Guidelines: Information Officers Invite
• Invitation for Applications for Prior Authority
• InfoRegSA Policy: Web Privacy
• InfoRegSA PAIA Guide in English, Afrikaans and Sesotho

60. Legislation

• POPI Act (75 pages)
• National Health Act (66 pages)
• PAIA Act (107 pages)
• RICA, ECTA, BOR, Cybercrimes Act

61. Regulations

• Regulations Relating to the Protection of Personal Information (91 pages)

62. POPI Act Compliance Management Framework

• 62.1 Toolkit

Checklists and Guidelines

63. Checklists

• 63.1 Employment Records
• 63.2 Staff Awareness Training
• 63.3 Questionnaire: POPI Act Implementation
• 63.4 Section 17 Documentation of Processing Operations
• 63.5 Data Subject Rights Forms and Procedures

64. Guidelines

• 64.1 Cybersecurity Practices for Small Health Care Organisations
• 64.2 Are You a Responsible Party or an Operator?
• 64.3 Understanding Whether You Are Processing Personal Information
• 64.4 Documentation of Processing Operations
• 64.5 Data Subject Rights
• 64.6 Information Regulator Guidance Note on Applications for Prior Authorisation
• 64.7 The Online Disinhibition Effect

65. Regulator

• 65.1 Information Regulator: Registration of Information Officer
• 65.2 Authorisation Letter: Information Officer
• 65.3 Designation Letter: Deputy Information Officer
• 65.4 Registration of Information Officers + Manual Online Registration
• 65.5 Terms and Conditions for Website
• 65.6 Disclaimer/s
• 65.7 Copyright Notice
• 65.8 Disclaimer Examples

Terms and Conditions Assent Compliance

All POPIA & PAIA Compliance Files are custom made per Practice. Please klick the Link to fill in the Request so that our Compliance Manager can contact you for more details and information.