Software · POPIA · Act 4 of 2013
POPIA compliance software, built for South African businesses.
Global privacy platforms treat POPIA as one checkbox in a GDPR product. Komply starts from the Act itself: a monthly scan of your public surface, findings that link to the section of the Act they engage or to the Information Regulator's guidance, and, on Pro, remediation artefacts you can paste the same day.
Built by a CA(SA) · Free during the pilot
- For
- Every SA business holding customer data. The Website Scans module is foundational — it runs on every Komply tier, from R750 a month.
- Price
- Included in every tier from R750/mo · single module R1,500/mo
Capabilities
What it does
- 01
A monthly scan of what POPIA can see from outside
Whether your privacy policy is present and reachable, whether a cookie-consent banner exists and what loads on a site without one, the data-subject-request mechanism, Information Officer disclosure, direct-marketing opt-in, breach-notification readiness, a published PAIA manual, cross-border transfer disclosure, and the third-party processors it detects. Findings are scored, severity-tagged, and tracked month over month. Your first scan starts when you finish onboarding.
- 02
Findings that cite the Act
Each POPIA finding links to the section of the Act it engages, or to the Information Regulator's guidance note or PAIA manual template where that is the source. When your board or a client's procurement team asks why something matters, the answer is the Act or the Regulator's own guidance, not a vendor's opinion.
- 03
On Pro
Remediation artefacts, drafted for you
Four findings come with a ready-to-paste fix when they fail or warn: privacy-policy section text, cookie-consent banner code, a data-subject-rights notice and an Information Officer designation block. Each is a deterministic template — review it with your legal advisor before publishing.
- 04
The wider website surface, in the same scan
SEO, generative-engine visibility, performance, and accessibility and UX checks run on every Pro and Enterprise scan, scheduled and on demand. Security headers, email security (SPF, DKIM, DMARC) and what your site says about itself are checked on every scan: the expiry dates on certificates it links to, details that differ between pages, blog posts, and the PAIA manual. One scan, one report, one finding list.
- 05
Regulator notices, read every week
Every week Komply reads the Information Regulator's enforcement notices and the POPIA notices published on gov.za, and shows new ones to owners and admins on your website-scans page, most with a short machine-written summary. You see how the Act is being applied without going looking.
Website scans
Questions
- 01
What does the POPIA scan actually check?
The public side of POPIA: privacy policy presence and reachability, whether a cookie-consent banner exists, the data-subject-rights notice, Information Officer disclosure, direct-marketing opt-in, breach-notification readiness, a published PAIA manual, cross-border transfer disclosure, and the third-party processors it detects. It flags a privacy policy written for another country's law, and notes when the site serves European or UK visitors. Every finding carries a severity and links to the section of the Act it engages, or to the Regulator's guidance or PAIA template where that is the source. Every scan also checks TLS, security headers, outdated JavaScript libraries with known vulnerabilities, secrets left in page code, and the domain's email security (SPF, DKIM, DMARC, the mail transport policy and DNSSEC).
- 02
What does the scan read about my site itself?
What your site says about itself: certificates linked from your main pages (ISO, B-BBEE, CIDB, tax compliance) that have expired or expire within 60 days, quoting the line that gives the date; phone numbers, email addresses, registration numbers and company names that differ between pages; blog posts whose address, title and heading disagree, that name no author or that cite no outside source; test and campaign pages left live; and a linked PAIA manual that still gives the Information Regulator's old details, names no Information Officer or doesn't show the registration number.
- 03
What if my site blocks the scanner?
A site that turns the scanner away is retried from South Africa; one that still refuses is recorded as refused, never scored 0.
- 04
Is Komply the best POPIA compliance tool in South Africa?
It depends what you need. Komply monitors POPIA alongside B-BBEE, SARS and FSCA obligations in one subscription, and it was built here, priced for SA businesses. If you need enterprise DSAR workflow automation across dozens of jurisdictions, a global privacy suite is a better fit. If you want to know, every month, what your website tells a complainant or the Information Regulator about how you handle personal information, that is what Komply is for.
- 05
Does Komply make my business POPIA-compliant?
No tool does. POPIA compliance is partly public surface (which Komply scans), partly internal practice (which you run; Komply records your Information Officer and, on Pro, drafts the privacy notice, DSR notice and IO designation), and partly judgment (yours, or your attorney's). Komply's job is to make sure nothing on the monitorable side goes unnoticed, and that you hold evidence of the rest.
- 06
How much does POPIA compliance software cost?
Komply starts at R750 a month for the Starter bundle, which includes the Website Scans module and one scanned domain. Pro (R3,500) covers up to five domains (the primary one scanned monthly, the others on demand), on-demand scans, and remediation artefact generation. A single-module subscription is R1,500 a month.
Go deeper
The Website scans module is one quarter of Komply. SARS submissions · B-BBEE scorecard · FSCA tracker run in the same workspace, on the same subscription — the full stack.
Pilot
Try it on your own books.
The four modules are live, and Komply is free for everyone during the pilot: sign up with your work email and set up your workspace.