POPIA in Production
Most organisations have a privacy policy. Far fewer can show the mechanism that keeps each promise in it, or the evidence that the mechanism ran. This eight-part series is for the engineers, architects, data teams and managers who run the systems personal information flows through. Parts 1 to 6 map POPIA's eight conditions to controls and a control register, treat purpose and lawful basis as attributes a platform can check, build retention as a deletion pipeline that reaches logs, backups and vector indexes, design access and correction requests as a system capability, set out an incident classification path agreed in advance, and end with governance after an AI feature fails. They follow Amanzi Credit, a fictional Gqeberha store-card and personal-loan lender; its systems, incidents and figures are illustrative. Parts 7 and 8 examine two real, public enforcement matters: the Information Regulator's notices to the Department of Justice over lapsed security licences, and the dispute over publishing matric results by examination number. They describe only the published record, and both matters were still open when written. The series is general information, not legal advice; section references and the Information Regulator's reporting route were checked on 31 October 2026, and the court and enforcement records in Parts 7 and 8 on 3 November 2026.
8 articles
- Part 1A privacy policy is not a privacy controlMost South African organisations have a privacy policy. Far fewer can show the mechanism that keeps each promise in it, or the evidence that the mechanism ran. Part 1 of POPIA in Production maps the Act's eight conditions to controls and evidence, and introduces the control register.10 min read
- Part 2Lawful basis is a design input, not a legal footnoteWhether a new use of personal information is allowed is usually asked after the pipeline already exists. Part 2 of POPIA in Production treats purpose and lawful basis as attributes of the data, carried through every pipeline, and puts a further-processing gate in front of new uses, AI features included.9 min read
- Part 3Retention is a deletion pipeline, not a scheduleMost retention schedules are spreadsheets that nothing executes. Part 3 of POPIA in Production treats retention as a pipeline: a rule catalogue, triggers from systems of record, an executor for every store including vector indexes and traces, and a deletion record that proves it ran.8 min read
- Part 4An access request is a test of your whole systemWhen a customer asks what you hold about them, the answer depends on whether you can find one person across every system, including the scores, segments and AI summaries you generated. Part 4 of POPIA in Production treats access and correction requests as an engineering capability, not a desk procedure.8 min read
- Part 5Classify the incident before you argue about itWhen something goes wrong with personal information, teams lose hours arguing about whether it counts as a breach. Part 5 of POPIA in Production turns sections 19, 21 and 22 and the Information Regulator's guidance into a classification path agreed in advance, so the day itself is spent on facts.8 min read
- Part 6Governance after an AI failureAn AI feature put one customer's details into another customer's summary. What happens next decides whether the organisation learns anything. Part 6 of POPIA in Production sets out the governance sequence after an AI failure: contain, classify, reconstruct, fix the control rather than the person, and re-enable on evidence.8 min read
- Part 7A security licence expired. The governance failure started earlierIn 2023 the Information Regulator fined the Department of Justice R5 million for not complying with an enforcement notice about lapsed security licences. Part 7 of POPIA in Production reads the public record as a control lesson: a safeguard can fail long before an attacker arrives, and an order from the Regulator is an obligation with a clock.8 min read
- Part 8Is an examination number personal information? It depends on identifiabilityA 2024 headline said the Department of Basic Education was fined R5 million for publishing matric results. The High Court later set both notices aside, and the matter has moved on since. Part 8 of POPIA in Production uses the dispute to explain contextual identifiability and why an obligation register needs versions.9 min read
Working through any of this in your own organisation?
These articles come out of delivery work rather than theory. If the problems in this series look familiar, a short scoping conversation is usually the quickest way to work out what is worth doing first.
Talk to CloudNala