A PIIA under Regulation 4(1)(b) of POPIA, run as a working file rather than a form.
POPIA requires the responsible party to protect the integrity and confidentiality of personal information in its possession or under its control. That includes identifying reasonably foreseeable internal and external risks, establishing and maintaining safeguards, verifying those safeguards, and updating them when new risks appear.
Regulation 4(1)(b) requires the Information Officer to ensure a Personal Information Impact Assessment is conducted so those measures exist. A PIIA is not an enterprise-risk review. It looks at what the processing does to data subjects. Every instance of processing is an interference with their rights and must be justified. Residual risk to those rights is not treated as acceptable by default.
The assessment starts with a systematic description of the processing and its purposes, including any legitimate interest under Section 11(1)(f). Where appropriate, data subjects are asked for their views so necessity and proportionality under Sections 10 and 11 can be tested. It is complete when it records the measures that address the risks that were found, including breach notification under Section 22.
The platform walks the responsible party, the Information Officer and the project owner through four stages. Templates sit inside the work. They record it. They are not a substitute for it.
1. Context. Describe the processing, its purpose and expected benefits. Name the responsible party and any operators. List the law, codes and standards that apply. Record the personal information, recipients, retention, supporting assets and the data flow from collection to erasure.
2. Conditions for lawful processing. Test purpose specification, lawfulness, minimality, information quality and retention. Then test the controls that protect data-subject rights: notices, consent where used, access, correction, restriction and objection, operator contracts under Sections 20 and 21, and transfers under Section 72.
3. Information-security risks. Assess existing or planned controls. For illegitimate access, unwanted change and loss of data, estimate impact and likelihood from the data subject's position. Record residual risk and the extra controls still required.
4. Validation. Pull the findings into a file the responsible party can accept, accept only with named improvements, or refuse. Record the Information Officer's advice and, where taken, the views of data subjects. Review the file when the purpose, the technology or the risk changes.
It is the working file for that process: shared access, named templates, an action plan, and a validation decision. The output is a PIIA the Information Regulator can sample and the board can see was done before the processing went live.
