What Happens After a POPIA Complaint?

For most practice owners, a POPIA complaint is a distant, abstract worry — until it isn't. This article outlines, in practical terms, what tends to happen after a complaint is lodged, and what you can do now to be ready.

This is general information, not legal advice. If you face an actual complaint, engage a legal professional.

Where complaints go

POPIA complaints are typically lodged with the Information Regulator. The Regulator has the authority to investigate, to attempt informal resolution, and in serious cases to issue enforcement notices and fines.

What the Regulator typically asks

If a complaint is investigated, the practice will generally be asked to demonstrate what it did to protect the personal information in question. The questions tend to revolve around:

• What controls did you have in place?
• Were they documented?
• Were staff trained on them?
• Did you have an operator agreement with any third party involved?
• Did you have an incident response process, and did you follow it?
• What did your Information Officer do?

What 'reasonable steps' actually means

POPIA doesn't require perfection. It requires reasonable, appropriate measures. A practice that can show it took documented, operational steps — trained staff, written procedures, operator agreements, an incident plan — is in a far stronger position than one that says 'we thought our IT company handled that'.

How to prepare before a complaint happens

• Name your Information Officer and make sure they know what the role involves.
• Document your patient-data handling procedures — even simply.
• Ensure operator agreements are in place with every third party that touches patient data.
• Train your staff and keep a record of the training.
• Have an incident response plan — even a one-page one — and know who leads it.
• Review all of the above periodically. A document from three years ago that nobody has looked at since is not a control.

The bottom line

A POPIA complaint is stressful, but it's survivable — especially for a practice that can demonstrate it took reasonable, documented, operational steps. The practices that struggle are the ones that assumed compliance was someone else's job and never built the controls into their daily operations.