POPIA and Your ERP: What the Act Asks of the System

What the Act expects, in ERP terms

The Information Regulator supervises the Act. The obligations most relevant to an ERP programme:

Process personal information lawfully, for a specified purpose, with minimality

Appoint and register an Information Officer

Honour data-subject requests for access, correction and deletion

Secure information with appropriate technical and organisational measures

Notify the Regulator and affected data subjects of a compromise as soon as reasonably possible

Control transfers of personal information outside South Africa

What that means for the build

Role-based access by least privilege. An audit trail of who viewed or changed sensitive records. Retention rules for payroll and HR data. Masking in test and training environments. A written operator agreement with your implementer and with Microsoft. A documented decision about where data is hosted and processed.

Where we help

We design to the Act in the Design phase, document the processing for your records and impact assessment, and sign an operator agreement on request. Software Dynamics SA (Pty) Ltd acts as an operator on your data.

How an engagement runs

It starts with a 45-minute consultation, then a discovery and fit-gap workshop on your own processes. You receive a written fit-gap and a phased plan before a programme is agreed. Four phases follow, each with something you can use and review.

Entdecke

Prozessworkshops, Datenprüfungen und eine Passungslücke im Vergleich zum Standardprodukt.

Konstruktion

Lösungsplan, Integrationskarte und die Erweiterungen, die wir tatsächlich brauchen werden.

Einsatz

Konfiguration, Migrationsproben, rollenbasierte Schulungen, UAT und phasenweise Umschaltung.

Unterstützung

Hypercare, Managed Services, Kundenportal, geplante Optimierungsbewertungen.

What drives the cost: users, legal entities and currencies, integrations, data migration and the gaps found against standard. See how pricing works or run the three-minute readiness score.

Häufig gestellte Fragen

Do we need an Information Officer?

Responsible parties must have one and register them with the Regulator. Check current registration requirements with the Information Regulator or your legal adviser.

Is cloud hosting allowed?

Yes, subject to the Act's conditions on operators and cross-border transfers. We document where data is stored and processed.

Can you sign an operator agreement?

Yes, on request, as part of the contract.

General information, not tax or legal advice. Rates, thresholds, due dates and filing rules change; confirm the current position with SARS, the relevant regulator or your registered tax practitioner before relying on it.

Last reviewed 2026-10-11

POPIA and your ERP.