SA +27 72 972 3135 KE +254 768 341 410 AU +61 423 605 291 sales@softwaredynamicsgroup.com
South African compliance South African compliance · Data protection

POPIA and your ERP.

An ERP holds employee, customer and supplier personal information. POPIA turns design choices about access, retention and hosting into legal obligations. This is the practical list.

← South Africa hub

What the Act expects, in ERP terms

The Information Regulator supervises the Act. The obligations most relevant to an ERP programme:

Process personal information lawfully, for a specified purpose, with minimality
Appoint and register an Information Officer
Honour data-subject requests for access, correction and deletion
Secure information with appropriate technical and organisational measures
Notify the Regulator and affected data subjects of a compromise as soon as reasonably possible
Control transfers of personal information outside South Africa

What that means for the build

Role-based access by least privilege. An audit trail of who viewed or changed sensitive records. Retention rules for payroll and HR data. Masking in test and training environments. A written operator agreement with your implementer and with Microsoft. A documented decision about where data is hosted and processed.

Where we help

We design to the Act in the Design phase, document the processing for your records and impact assessment, and sign an operator agreement on request. Software Dynamics SA (Pty) Ltd acts as an operator on your data.

How an engagement runs

It starts with a 45-minute consultation, then a discovery and fit-gap workshop on your own processes. You receive a written fit-gap and a phased plan before a programme is agreed. Four phases follow, each with something you can use and review.

01

Discover

Process workshops, data audit, and a fit-gap against the standard product.

02

Design

Solution blueprint, integration map, and the extensions we will actually need.

03

Deploy

Configuration, migration rehearsal, role-based training, UAT and phased cutover.

04

Support

Hypercare, managed services, client portal, scheduled optimisation reviews.

What drives the cost: users, legal entities and currencies, integrations, data migration and the gaps found against standard. See how pricing works or run the three-minute readiness score.

Frequently asked questions

Do we need an Information Officer?

Responsible parties must have one and register them with the Regulator. Check current registration requirements with the Information Regulator or your legal adviser.

Is cloud hosting allowed?

Yes, subject to the Act's conditions on operators and cross-border transfers. We document where data is stored and processed.

Can you sign an operator agreement?

Yes, on request, as part of the contract.

General information, not tax or legal advice. Rates, thresholds, due dates and filing rules change; confirm the current position with SARS, the relevant regulator or your registered tax practitioner before relying on it.

Last reviewed 2026-10-11

Let's talk Solutions.

Plan Your ERP & CRM Roadmap with Our Experts.

Book a consultation Estimate your return
Call Book a consultation
Software Dynamics
Typically replies within business hours (EAT)
Hello. What are you trying to solve? Pick one and we will route you to the right person. I want to see a demo I am an existing client and need support Tell me about electronic invoicing