Product
POPIA Security and Breach Kit
Meet POPIA section 19 and handle a breach correctly, without a large consulting bill.
The security side of POPIA: safeguards policies, operator checks, and a section 22 breach playbook with the Information Regulator's eServices steps. Information, not legal advice.
For: South African businesses that hold customer or staff personal information.
Choose your edition
Each edition includes everything in the one before it. Pay once; updates for 12 months are included.
Essentials
The safeguards in writing.
R990
Once-off, one organisation. Excludes VAT where it applies.
- Nine security safeguards policies mapped to section 19
- Section 19 risk assessment with 19 starter risks
- Information Officer registration walkthrough
- Operator due-diligence and contract-clause checklists
- Editable Word files
- Most chosen
Complete
Safeguards plus a breach plan you can follow.
R2 490
Once-off, one organisation. Excludes VAT where it applies.
- Everything in Essentials
- Section 22 breach playbook, step by step through eServices
- Notification templates for the Regulator and data subjects
- Breach register (Excel)
- 13-slide staff awareness deck with presenter notes
Plus review
A security engineer checks your setup with you.
R4 990
Once-off, one organisation. Excludes VAT where it applies.
- Everything in Complete
- 15-question scored self-assessment
- One 60-minute review call with a security engineer
- Written follow-up summary with your priorities
What is inside
Essentials edition
- Nine safeguards policies
- Information security, access control, passwords and MFA, devices and encryption, backup, acceptable use, clean desk, supplier security, and retention and destruction.
- Section 19 risk assessment
- Identify, safeguard, verify and update, with 19 starter risks to adapt.
- Information Officer walkthrough
- Registering your Information Officer and deputies, based on the Regulator's own 2025 guide.
- Supplier checklists
- Due diligence for the providers that handle your data, and the clauses to ask your attorney for (sections 20 and 21).
Complete edition adds
- Section 22 breach playbook
- From discovery to closure: contain, assess, decide, notify through eServices, and learn. You must be registered on the portal before you can report, so the kit starts there.
- Notification templates
- The Regulator's online form fields, a covering letter, and email, letter and website notices with everything section 22(5) requires.
- Breach register
- Every compromise recorded, reported or not, with a dashboard (Excel).
- Staff awareness deck
- Thirteen slides with presenter notes, so a manager can run the session.
Plus review edition adds
- Self-assessment
- Fifteen scored questions to see where you stand before the call.
- Review call and summary
- Sixty minutes with a security engineer, then a written summary of your priorities.
Questions
Does this make us POPIA compliant?
No kit can. This covers the security safeguards and breach response. Your privacy notice and PAIA manual should come from an attorney.
How do I pay and receive the files?
Order the edition you want and we email you a secure payment link in rand or US dollars. Once it is paid, the files are delivered by email and to your Sys-Ki client portal.
Can I use it in more than one company?
Each purchase covers one organisation. Consultants and IT providers who want to use a kit with their own clients can ask us for a consultant licence.
Is this legal advice?
No. The kits are practical templates and guidance from a security engineer. Have policies that carry legal weight reviewed by your attorney or data protection officer before you adopt them.
Prefer it done for you?
Rather have the safeguards put in place for you? Our security services start with email and domain security.