Privacy Policy (POPIA)

Template Overview

  • Template ID: privacy-policy-popia
  • Version: 1.0.0

To generate this document, pass the structured data described below into the data property of the /api/v1/documents/generate endpoint.

Data Payload Schema

FieldTypeRequirementDescription & Details
companyNamestringYesLegal name of your organisation The full registered name of the responsible party that publishes this policy. Ex: Acme Technologies (Pty) Ltd
companyTypestringYesType of entity Options: "Private Company ((Pty) Ltd)", "Public Company (Ltd)", "Personal Liability Company (Inc.)", "Close Corporation (CC)", "Non-Profit Company (NPC)", "Partnership", "Sole proprietor / Business name", "Trust"
registrationNumberstringNoCompany / entity registration number CIPC registration number. Ex: 2019/123456/07
addressstringYesRegistered address Full street address including city and postal code. Ex: 12 Bree Street, Cape Town, 8001
websitestringYesWebsite URL Ex: https://acme.co.za
contactEmailstringYesContact email for privacy matters Where data subjects can reach you. Ex: privacy@acme.co.za
effectiveDatestringNoWhen does this policy take effect? The date the policy becomes active. Ex: 2026-01-01 (Format: YYYY-MM-DD.)
lastUpdatedstringNoWhen was this policy last updated? Review and update at least annually. (Format: YYYY-MM-DD.)
productNamestringYesProduct or service name Ex: Vega
productDescriptionstringYesBrief description of the product 1-2 sentences describing what your product does.
audiencestringYesWho is your product for? Options: "B2B (businesses only)", "B2C (consumers only)", "Both businesses and consumers"
minimumAgestringYesMinimum user age POPIA treats anyone under 18 as a child; processing a child's information generally requires competent-person (parent/guardian) consent under section 34-35. Options: "13", "16", "18"
dataCategoriesarray of stringsYesWhich categories of personal information do you process? Select every category that applies. Options: "Account information (name, email, password)", "Profile information (role, organisation, photo)", "Uploaded documents and content", "Payment information", "Usage and analytics data", "Device and log data (IP address, browser, OS)", "Communications (support tickets, emails)", "Cookies and tracking technologies", "Location data", "Marketing preferences"
processingConditionsarray of stringsYesOn which POPIA condition(s) do you rely to process personal information? POPIA does not use GDPR 'legal bases'. Select the section 11 justification(s) you rely on. Options: "Consent of the data subject (s11(1)(a))", "Necessary to conclude or perform a contract (s11(1)(b))", "Compliance with a legal obligation (s11(1)(c))", "Protects a legitimate interest of the data subject (s11(1)(d))", "Necessary for the proper performance of a public law duty (s11(1)(e))", "Pursues the legitimate interests of the responsible party or a third party (s11(1)(f))"
collectsSpecialPersonalInfobooleanNoDo you intentionally process special personal information? Under POPIA s26, special personal information means religious/philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour.
specialPersonalInfoDescriptionstringConditionalDescribe the special personal information processed and the s27 ground relied on POPIA prohibits processing special personal information unless a s27 exemption applies (e.g. consent, establishment of a legal right, public interest). Required if collectsSpecialPersonalInfo is true.
processesChildrenInfobooleanNoDo you knowingly process the personal information of children (under 18)? POPIA s34 prohibits processing children's information unless a s35 ground applies (e.g. consent of a competent person).
usesAIbooleanNoDoes your product use AI to process personal information?
aiProvidersarray of stringsConditionalWhich AI providers do you use? Options: "Google (Gemini)", "OpenAI", "Anthropic (Claude)", "Mistral", "Cohere", "AWS Bedrock", "Azure OpenAI", "Self-hosted model" Required if usesAI is true.
trainsOnUserDatabooleanConditionalDo you train your AI models on user data? If 'No', your policy will state personal information is not used for AI training. Required if usesAI is true.
primaryHostingLocationstringYesPrimary hosting / storage location Where is personal information primarily stored and processed? Options: "South Africa", "European Union", "United Kingdom", "United States", "Nigeria", "Kenya", "Other"
transfersCrossBorderbooleanNoIs personal information transferred outside South Africa? Section 72 restricts transfers of personal information outside the Republic. Triggers a transfer-safeguards clause.
crossBorderSafeguardsarray of stringsConditionalWhich section 72 ground(s) permit your cross-border transfers? Options: "Recipient is subject to a law / binding rules providing adequate protection (s72(1)(a))", "Data subject consents to the transfer (s72(1)(b))", "Transfer is necessary to perform a contract with the data subject (s72(1)(c))", "Transfer is for the data subject's benefit and consent is not reasonably practicable (s72(1)(d)/(e))" Required if transfersCrossBorder is true.
additionalHostingLocationsarray of stringsConditionalAdditional regions where information may be stored Optional. Options: "United States", "European Union", "United Kingdom", "Nigeria", "Asia Pacific" Required if transfersCrossBorder is true.
operatorsarray of objectsYesList your operators (third parties that process personal information on your behalf) Under POPIA an 'operator' processes personal information for a responsible party. Add each vendor. Each entry: name (string), purpose (string), location (string). (Minimum 1 entry.)
informationOfficerNamestringYesInformation Officer name Under POPIA the head of a private body is the Information Officer by default. They must be registered with the Information Regulator.
informationOfficerEmailstringYesInformation Officer email
informationOfficerRegisteredbooleanNoIs your Information Officer registered with the Information Regulator?
hasDeputyInformationOfficerbooleanNoHave you designated a Deputy Information Officer?
deputyInformationOfficerstringConditionalDeputy Information Officer name and email Required if hasDeputyInformationOfficer is true.
hasPAIAManualbooleanNoDo you have a PAIA manual? POPIA amended PAIA. A PAIA manual is required and the privacy policy should cross-reference it.
paiaManualUrlstringConditionalLink to your PAIA manual Required if hasPAIAManual is true.
hasDPAbooleanNoDo you offer an Operator Agreement / DPA to business customers? Section 21 requires a written contract with operators.
accountRetentionMonthsnumberNoMonths to retain account data after closure Section 14 requires you not to retain records longer than necessary. Ex: 12
customerDataRetentionDaysnumberNoDays to retain customer data after subscription ends Ex: 30
logRetentionMonthsnumberNoMonths to retain logs and security data Ex: 12
usesCookiesbooleanNoDoes your product use cookies or similar tracking?
usesAnalyticsbooleanConditionalDo you use analytics cookies (e.g. Google Analytics, Mixpanel)? Required if usesCookies is true.
sendsMarketingEmailsbooleanNoDo you send electronic direct marketing? Section 69 requires opt-in consent for electronic direct marketing to non-customers, in the prescribed Form 4.

Example JSON Payload

Here is an example of a properly formatted data object for the Privacy Policy (POPIA) template.

{
  "templateId": "privacy-policy-popia",
  "data": {
    "companyName": "Acme Technologies (Pty) Ltd",
    "companyType": "Private Company ((Pty) Ltd)",
    "registrationNumber": "2019/123456/07",
    "address": "12 Bree Street, Cape Town, 8001",
    "website": "https://acme.co.za",
    "contactEmail": "privacy@acme.co.za",
    "effectiveDate": "2026-01-01",
    "lastUpdated": "2026-06-01",
    "productName": "Vega",
    "productDescription": "Sample Product Description",
    "audience": "B2B (businesses only)",
    "minimumAge": "13",
    "dataCategories": [
      "Account information (name, email, password)",
      "Profile information (role, organisation, photo)"
    ],
    "processingConditions": [
      "Consent of the data subject (s11(1)(a))",
      "Necessary to conclude or perform a contract (s11(1)(b))"
    ],
    "collectsSpecialPersonalInfo": false,
    "processesChildrenInfo": false,
    "usesAI": true,
    "aiProviders": [
      "Google (Gemini)",
      "OpenAI"
    ],
    "trainsOnUserData": false,
    "primaryHostingLocation": "South Africa",
    "transfersCrossBorder": true,
    "crossBorderSafeguards": [
      "Recipient is subject to a law / binding rules providing adequate protection (s72(1)(a))",
      "Data subject consents to the transfer (s72(1)(b))"
    ],
    "additionalHostingLocations": [
      "United States",
      "European Union"
    ],
    "operators": [
      {
        "name": "Google LLC",
        "purpose": "Hosting, storage, authentication",
        "location": "South Africa (africa-south1)"
      }
    ],
    "informationOfficerName": "Sample Information Officer Name",
    "informationOfficerEmail": "legal@acmecorp.com",
    "informationOfficerRegistered": true,
    "hasDeputyInformationOfficer": false,
    "hasPAIAManual": true,
    "paiaManualUrl": "https://www.acmecorp.com",
    "hasDPA": true,
    "accountRetentionMonths": 12,
    "customerDataRetentionDays": 30,
    "logRetentionMonths": 12,
    "usesCookies": true,
    "usesAnalytics": false,
    "sendsMarketingEmails": false
  },
  "format": "pdf"
}