Frequently Asked Questions

POPIA is the Protection of Personal Information Act 4 of 2013. It applies to every organisation in SA that processes personal information — from sole proprietors to listed companies. If you collect names, emails, phone numbers, or any identifying data, POPIA applies.

Accountability, Processing limitation, Purpose specification, Further processing limitation, Information quality, Openness, Security safeguards, Data subject participation.

Fines up to R10 million and/or imprisonment up to 10 years. The Information Regulator issued its first R500k fine in Q2 2026 and has begun proactive audits.

A designated person responsible for encouraging POPIA compliance within your organisation and handling data subject requests. Must be registered with the Information Regulator.

Yes. Employee personal information (payroll, medical records, performance reviews) is fully protected under POPIA.

Race, ethnicity, religion, health, sexual orientation, biometrics, trade union membership, political opinions, criminal history. Subject to stricter processing rules under Sections 26-33.

A responsible party decides why and how personal information is processed — that's usually you. An operator processes it on your behalf (e.g. a payroll bureau, cloud provider, or email tool). You stay accountable for your operators, so POPIA requires a written operator agreement with each one. Talynth's Operators feature helps you track them and their agreements.

No — consent is only one of several lawful bases. POPIA also permits processing that is necessary for a contract, to meet a legal obligation, to pursue a legitimate interest, or to protect someone's vital interests. Consent is specifically required for things like electronic direct marketing to non-customers and for processing special personal information.

Section 69 restricts electronic direct marketing (email, SMS, automated calls) to people who have given consent or who are existing customers being marketed similar products. Every message must identify the sender and offer a clear way to opt out.

Click 'Get Started', enter your name, email, and password. You can also sign up with Google. No credit card required.

About 15 minutes for most SMEs. You can save progress and come back anytime.

You instantly receive your compliance score with a breakdown per POPIA condition, prioritised gaps, and remediation steps.

Yes. Your assessment progress is automatically saved after each section.

Skip it and come back later, or check the help text beneath each question for guidance.

Each question is weighted by risk severity and mapped to a POPIA condition. Your score is a weighted average across all 8 conditions, with higher-risk areas (security, accountability) weighted more heavily.

Talynth automates the compliance work most SMEs need, and its documents are drafted by South African privacy attorneys — giving you a strong, defensible foundation. It is not a law firm, though. For complex processing, disputes, or bespoke contracts, consult a privacy attorney. Talynth is designed to get the 95% you can self-serve done in minutes.

Yes. Invite colleagues as Owner, Admin, or Member, and give external accountants, consultants, or auditors free read-only Auditor access. Everyone works from the same live compliance picture, and every action is logged.

Any South African organisation that processes personal information. The assessment has industry-specific variants for healthcare, finance, retail, and professional services that tailor the questions to your context — and it works for any other sector too.

Yes. Templates are drafted by SA privacy attorneys and mapped to POPIA requirements. Designed to satisfy Information Regulator expectations for SMEs.

Yes. Each section can be edited after generation. Your customisations are preserved across regenerations.

At least annually, or whenever your processing activities change materially. Talynth prompts you during quarterly reviews.

HTML preview in-app, downloadable as PDF.

Yes. Section 51 of PAIA requires every private body to compile and publish a manual describing records held and how to request access.

A Data Subject Access Request — when an individual asks you what personal information you hold about them, or requests correction/deletion.

POPIA requires you to respond to access requests within a reasonable time. Best practice aligned with PAIA is 30 days.

The data subject can complain to the Information Regulator. Repeated failures can lead to enforcement action.

Talynth provides a verification checklist. Typically: government-issued ID matching the name on record.

Yes, on specific grounds (e.g., legal privilege, safety concerns, manifestly unfounded). You must provide reasons and inform of the right to complain.

Any unauthorised access to, or acquisition of, personal information that may pose a risk to data subjects.

Section 22 requires notification 'as soon as reasonably possible'. Best practice is 72 hours to the Information Regulator.

The Information Regulator AND affected data subjects (unless identity is unknown).

Detection procedures, containment steps, assessment criteria, notification templates, roles and responsibilities, recovery procedures.

Yes — Talynth uses AI (via AWS Bedrock) to assist with evidence verification, drafting DSAR responses, and breach triage. AI is assistive, not autonomous: it drafts and suggests, but a person always reviews and approves before anything is used or sent. AWS does not use your inputs to train its foundation models.

Upload a document as evidence for a compliance answer and Talynth's AI checks it against what the answer claims, returning a status — Verified, Partial, Invalid, or Unreadable — with a plain-language reason and a suggestion. Verified evidence strengthens your score; weak or missing evidence is flagged so you can fix it before an auditor does.

Compliance is ongoing, not a once-off certificate. Your score decays gradually if you don't re-attest, reflecting that policies and practices go stale. Talynth prompts a quarterly review to refresh it, so your score always represents your real, current posture.

Yes. Assign POPIA awareness training to team members, track who has confirmed completion, send reminders, and keep an auditable record. Trainees are a free role and don't consume a seat.

An embeddable widget for capturing and recording data-subject consent on your website, with a timestamped, auditable log of what each person consented to and when. Available on higher plans.

Yes. Record the operators who process personal information on your behalf, store their operator agreements, and get reminders when an agreement needs review — because POPIA holds you accountable for your operators.

Every compliance action — assessments, document changes, DSAR responses, breach steps, and evidence uploads — is timestamped and logged. Professional and Enterprise plans add natural-language search over the audit trail so you can find any event fast.

Yes. Enterprise supports SSO via Google and Microsoft Entra ID — commonly required by corporates with 100+ employees.

Enterprise includes API access through a secure request-and-approve token flow (scoped and rate-limited). Accounting-system integrations (Sage / Xero) for automated evidence collection, extra API quota, and bespoke integrations are available as optional add-on modules.

Four plans: Free (1 user, score + privacy policy), Starter at R499/month (2 users, full compliance suite), Professional at R1,499/month (3 users, evidence management, audit trail, regulatory alerts), and Enterprise at R4,999/month flat (unlimited users, metered by entities, all features). Annual billing gives 1 month free on every paid plan.

Each plan includes a fixed number of licensed users: Free 1, Starter 2, Professional 3. There are no paid extra seats — when a Professional org needs a 4th user it moves to Enterprise, which has unlimited users (metered by entities, not seats). The free roles (Auditor and Viewer, view-only; Trainee, self-training) are unlimited on every plan and never consume a licensed seat.

Yes. No lock-in contracts. Cancel from settings, retain access until billing period ends.

Debit/credit card via PayStack (Visa, Mastercard). Rand-denominated.

The Free plan is permanent (1 user). Paid plans include a 14-day free trial. Enterprise is a flat R4,999/month for unlimited users (metered by entities: 4 included, then per-entity) and is self-serve for the base — multi-entity beyond 10 and bespoke integrations are handled via a consultative Enterprise quote.

Owner (full access + billing), Admin (manage compliance + documents), and Member (view dashboards + respond to DSARs) all consume a seat. The Auditor role is free — designed for external accountants, consultants, or auditors who only need read-only access to reports and compliance status.

Your data is retained for 90 days after cancellation for export. After that it's securely deleted.

Yes, upgrade or downgrade anytime from Settings. Changes take effect immediately.

Enterprise (R4,999/month flat, unlimited users) is for organisations with elevated obligation complexity — special personal information (§26–33), cross-border transfers (§72), or multiple legal entities under one account — or that need SSO/SAML, annual invoicing, or API access. It's not about user count; it's about obligation complexity. The base is self-serve; multi-entity beyond 10 and bespoke integrations are quoted.

You get immediate access to all features on the new plan. You're charged a pro-rated amount for the remaining days in your current billing cycle at the new plan rate. For example, if you upgrade from Starter (R499) to Professional (R1,499) halfway through your cycle, you pay the difference for the remaining 15 days — approximately R500. Your next full billing cycle will be at the new plan rate.

Your current plan features remain active until the end of your billing cycle — you've already paid for them. At the start of the next cycle, your plan switches to the lower tier. You'll see a confirmation dialog showing exactly which features and capabilities you'll lose before you confirm. No refund is issued for the current cycle.

When your downgrade takes effect (next billing cycle), you lose access to features not included in your new plan. Specifically: documents become read-only (you can view but not regenerate), features like evidence management or DSAR tracking are locked, and if your user count exceeds the new plan's limit, you'll need to deactivate users. Your data is never deleted — it's always accessible if you upgrade again.

All paid plans include a 14-day free trial. No credit card is required to start. During the trial, you have full access to all features on that plan. Before the trial ends, we'll prompt you to add a payment method. If you don't, your account automatically reverts to the Free plan — no charge, no penalty, and your data is retained.

When you add a user mid-cycle, you're charged a pro-rated amount for the remaining days. For example, adding a user at R99/month with 10 days left costs approximately R33 on your next invoice. When you remove a user, their access is revoked immediately but the reduced charge only applies from the next billing cycle — no refund for the current cycle.

Your data is never deleted immediately. On downgrade: all data remains, features are just locked until you upgrade again. On cancellation: you retain full access until the end of your billing cycle, then have 90 days to export your data (assessments, documents, DSARs, evidence). After 90 days, data is permanently and securely deleted.

Exclusively in AWS Cape Town (af-south-1). Never leaves South African borders.

Yes. Encrypted at rest (AES-256) and in transit (TLS 1.3).

Only you and your organisation's authorised users. Talynth staff cannot access your data without explicit permission.

Yes. We practise what we preach — full POPIA compliance including our own privacy policy, PAIA manual, and Information Officer registration.

Yes. Export all your data (assessments, documents, DSARs, evidence) in standard formats from Settings.

Yes. Databases are backed up automatically, and backups stay within AWS Cape Town (af-south-1) with the same AES-256 encryption and residency as your live data.

Never. We don't sell your data or use it for advertising. The only processors involved are the infrastructure providers needed to run the service (such as AWS for hosting), each governed by an operator agreement — exactly the discipline POPIA expects.

POPIA (the Protection of Personal Information Act 4 of 2013) was signed in 2013, commenced on 1 July 2020, and its one-year grace period ended on 1 July 2021 — so full compliance has been required since 1 July 2021.

The Information Regulator can issue enforcement notices and administrative fines of up to R10 million, and serious offences can carry criminal liability of up to 10 years' imprisonment. Beyond fines, non-compliance risks reputational damage and civil claims from affected data subjects.

POPIA is South Africa's data-protection law; the GDPR is the EU's. They share core principles (lawful processing, data-subject rights, breach notification, accountability), so GDPR-aligned organisations are part-way there — but POPIA has its own definitions, the Information Regulator as enforcer, specific conditions, and PAIA integration. Talynth is built specifically for POPIA.

Yes. Every organisation has an Information Officer by default — the head of the organisation (CEO/owner/MD) — who may delegate to Deputy Information Officers. The Information Officer must be registered with the Information Regulator before performing their duties. Talynth helps you appoint, register, and document this.

Registration is done through the Information Regulator's online portal; the registrant must be a CEO/Director (head of the organisation). Talynth generates the supporting appointment documentation and tracks the registration as compliance evidence.

In practice, yes. POPIA's 'Openness' condition requires you to tell data subjects how you process their personal information, which a privacy/PAIA notice delivers. Talynth auto-generates a POPIA-aligned privacy policy for you in minutes.

A PAIA manual is a document required under the Promotion of Access to Information Act explaining what records you hold and how to request them. Most organisations need one (some small private bodies had temporary exemptions that have largely lapsed). Talynth generates a PAIA manual aligned to your business.

Yes. POPIA applies to any 'responsible party' that processes personal information in South Africa, regardless of size — including sole proprietors. If you hold customer, employee, or supplier data, you're in scope. Talynth is designed specifically for SMEs who can't afford consultants.

Any information relating to an identifiable living person (and, uniquely to POPIA, an identifiable existing juristic person/company). That includes names, ID numbers, contact details, email addresses, location data, biometric data, and opinions. 'Special personal information' (health, religion, race, etc.) has extra protections.

Talynth is purpose-built for POPIA compliance for South African SMEs: a guided assessment, an instant compliance score, auto-generated documents (privacy policy, PAIA manual, data register), and DSAR/breach workflows — replacing R50k+ consultant engagements with a self-service platform you can start free.

With consultants, a POPIA engagement typically runs tens of thousands of rand. Talynth starts at R0 (Free plan) so you can get a compliance score and a privacy policy at no cost, with paid plans from R499/month for ongoing DSAR/breach management, monitoring, and more.

Yes — Talynth's Free plan lets you run the guided assessment, get your compliance score, and generate a privacy policy at no cost. You upgrade only when you need ongoing operational features like DSAR tracking, breach workflows, and monitoring.

The guided assessment takes about 15 minutes and immediately produces your compliance score and starter documents — hence 'POPIA compliance in 15 minutes, not 15 weeks.' Full operational compliance (DSAR/breach processes, evidence, reviews) is then maintained continuously in the platform.

Talynth effectively is one — the guided assessment walks you through POPIA's 8 conditions and every obligation that applies to your business, then shows exactly which gaps to close with 'Fix Now' guidance, rather than handing you a static checklist to interpret yourself.