POPIA asks every responsible party to know what personal information it processes, why, who it shares it with, and how it protects it, and to prove that to the Information Regulator if asked. Core GRC puts that work in one workspace, built and supported from Cape Town, with plans billed in South African rand.

New to the Act? Start with What is POPIA? (POPI Act meaning explained) or our POPIA compliance guide.

How Core GRC maps to POPIA

Accountability and openness: know what you process

The Privacy Risk & Compliance Suite records each processing activity with its purpose, lawful basis, data subjects, special personal information, retention, recipients, and cross-border transfers with their safeguards. Activities link to the vendors, assets and services that support them, so your records reflect how data actually moves.

Operators and section 21: assess the people who process for you

Keep every operator in a vendor register, let them submit their own details through the Onboard Hub, and send assessments they answer in a respondent portal, with evidence attached. Core IQ, the built-in AI assistant, runs reviews that apply the framework where you are based, including POPIA, and proposes register changes for you to confirm. Risks and issues raised in a review are tracked until they are closed.

For a step-by-step method, see our vendor risk assessment guide.

Cross-border transfers and section 72

Record transfers on each processing activity, with the recipient country and the safeguard you rely on, so you can show why each transfer meets one of the section 72 conditions.

Data subject participation: sections 23 to 25

The Privacy Rights module publishes intake forms for access, correction and deletion requests, verifies the person asking before anything is shared or deleted, and routes each request to the right people. Every request carries its deadline, and reports show what is open and how long responses took.

Openness and section 18: privacy notices

The Privacy Policies & Notices module lets you write notices in sections, require approval before anything goes live, keep every published version, and embed the notice on your site so it updates when you publish.

Direct marketing and website tracking

The Cookie Consent module scans your site for cookies, publishes a consent banner and preference centre, and holds back analytics and advertising scripts until visitors agree. Every choice is kept as a consent record.

Security safeguards: risks and evidence

Risk and issue registers, a risk heatmap and appetite views, and a document library give your Information Officer one place to see open risks, remediation status and supporting evidence.

Built for South African teams

  • Plans priced in rand for organisations billed in South Africa. See pricing.
  • Start with one module and add more as your programme grows.
  • Use Core GRC from Claude, Cursor, the CLI or the API. See AI and agents.

Frequently asked questions

Is Core GRC only for POPIA?

No. Reviews also apply UK GDPR, EU GDPR, LGPD, India's DPDPA, and Canadian and US law, which helps if you also process data about people outside South Africa.

Do I still need an Information Officer?

Yes. POPIA requires every responsible party to have an Information Officer registered with the Information Regulator. Core GRC supports their work; it does not replace the role.

Can I start small?

Yes. You can start with one module, such as Privacy Rights or Cookie Consent, and add the suite when you are ready to build full processing records and operator assessments.

Book a demo to see Core GRC set up for a POPIA programme.