POPIA Compliance Checker for AI-Built Apps

Why this tool never says "you're compliant"

POPIA puts its duties on your business, the "responsible party", not on the software you use. Compliance is what your business does over time: what it collects, who it shares it with, how it answers a request. No checklist captures that once and for all, and the Information Regulator doesn't issue a POPIA certificate for a tool to hand you. So every result here is a confirmed step, a gap or a question you haven't answered yet.

That's also why "not sure" counts as its own answer. "Needs attention" means you know the answer and it falls short. "Not yet assessed" means you haven't found out. Both need action, but different action: one needs fixing, the other needs checking.

Why the questions don't name any platform

Every AI website builder and backend raises the same underlying questions, whatever its screens look like: where the data sits, who else touches it, what agreement covers it. Those answers are what POPIA cares about, and they stay the same when a dashboard changes. Your provider's own settings and documentation tell you the specifics.

One trap applies to almost all of them. The region you pick for your database is where the data is stored. It isn't always the only place it goes. Backups, logs, email senders, analytics and AI services can each send copies somewhere else. That's why the tool asks about them separately, and why a South African main database doesn't settle the question on its own.

Where the data goes: what Section 72 asks

Section 72 doesn't ban storing personal information abroad. It says a responsible party may not transfer it to a third party in a foreign country unless one of five grounds applies. Three of them are in the tool: the recipient is bound by a law or agreement giving adequate protection, the person consents or the transfer is needed to perform a contract with them. The Act names no countries, so "adequate" is a test you apply, not a list you look up.

An overseas company's South African region is less clear-cut than it sounds. The Act asks whether the information goes to a third party in a foreign country, not only where the server sits. The tool treats it as a possible transfer, so you write down a ground either way. Our guide to what POPIA asks of your app's backend goes through all five grounds.

Written agreements: Section 21

Any service that stores or processes personal information for you is, in the Act's words, an "operator". Section 21 requires "a written contract between the responsible party and the operator" that makes the operator keep the information secure, and the Act makes the operator tell you if it suspects a breach. For most providers, that's their Data Processing Agreement. You need one for every operator: your database provider, but also your email sender, file storage and analytics.

What the sensitive-information warnings mean

POPIA's Section 26 prohibits processing "special personal information" unless one of the authorisations in the sections after it applies. It covers religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information and criminal behaviour. Section 34 does the same for information about a child (broadly, someone under 18; the Act's definition also looks at whether they're legally competent), with Section 35 setting out when it's allowed, starting with "the prior consent of a competent person", usually a parent or guardian.

Two checkboxes can't assess those rules responsibly, so the tool shows a warning instead of folding them into the readout. If either box applies, get a South African data-protection lawyer to look at your setup.

Who your Information Officer is

You don't hire one. Under the Act, the Information Officer of a private body is its head: for a sole trader, that's the owner; for a company, it's the chief executive or an equivalent person. What you do have to do is register them with the Information Regulator, because Section 55(2) says Information Officers "must take up their duties in terms of this Act only after the responsible party has registered them with the Regulator".

Turning the gaps into work for your AI

Most gaps in the "app controls" part are things your AI coding agent can build: access rules (start with our guide to adding login and sign-in to an AI-built app), a shorter sign-up form, a clean-up job for old records, a way to handle a request to delete an account. The data map prompt in our POPIA guide asks your AI to list every piece of personal information, where it goes and which tables have no access rules. Run it first, then come back and answer these questions from its answer. Your AI can't see your provider's region settings or your agreements, so those answers are yours to check.