POPIA holds the responsible party accountable for how operators process personal information on its behalf (sections 20 and 21), so you need to know who your operators are, what they process, and what security measures they have agreed to. Keep every vendor, asset, service, processing activity, and AI system in linked registers, send assessments, and track the risks and issues they raise until they're closed. Core IQ reviews apply POPIA when your organisation is based in South Africa, and processing activity records capture purposes, data subjects, special personal information, cross-border transfers under section 72, and retention.
Risk Suite · South Africa
Privacy, Risk & Compliance Suite
Keep operators, vendors, and processing activities in linked registers, assess them against POPIA, and track risks and issues to closure.
- Per month, excl. VAT
- From R3 499
- Capabilities
- 11
- Applied in reviews
- POPIA
Overview
Capabilities
What's included
Linked registers
Vendors, assets, services, and elements, each linked to the processing activities and AI systems that depend on them.
Onboard Hub
Share a registration link so vendors submit their own details. You review each submission before it becomes a record.
Assessments and Quick Assess
Build templates and send assessments. Respondents answer and upload evidence in the respondent portal, without a Core GRC account.
Core IQ
Research vendors, run full reviews that ask clarifying questions and propose register changes for you to confirm, and chat over your documents.
Jurisdiction-aware reviews
Reviews apply the data protection framework where you're based, including UK GDPR, EU GDPR, POPIA, LGPD, India's DPDPA, and Canadian and US law.
Processing activities
Record purposes, lawful bases, data subjects, special category data, cross-border transfers and safeguards, retention, and recipients.
AI governance
Inventory AI systems with risk level, lifecycle stage, model type, training data, bias assessment, and ethics review, and log AI incidents.
Risks and issues
Risk and issue registers with libraries of reusable risks and issues, and remediation tracked on the record.
Risk analytics
Executive summary, heatmap, risk appetite, trend, top risks, distribution, and breakdown views.
Documents and trust centres
Keep evidence on each record and in a global library, and capture vendor trust-centre pages and certificates.
Workflows and assignments
Route reviews and remediation to people and assignment groups with workflows.
Pricing
Tiers for this module
Prices are in South African rand, billed monthly, and exclude VAT.
Standard
R3 499/moexcl. VAT
- 75 vendors and 75 assets
- 200 assessments a month
- 200 AI chats a month
- Up to 15 users
- Risk analytics
Professional
R6 999/moexcl. VAT
- 250 vendors, assets, services, and AI systems
- 500 assessments a month
- 500 AI chats a month
- 50 Core IQ full reviews a month
- Up to 25 users
- Priority support
Enterprise
Custom
- Unlimited usage
- Custom limits and SLAs
- Dedicated support
- Custom integrations
Prices are in South African rand, billed monthly, and exclude VAT.
Privacy, Risk & Compliance Suite FAQ
Vendors, assessments, Core IQ, processing activities, and AI systems.
Do vendors need a Core GRC account to answer an assessment?
No. Respondents answer and upload evidence in the respondent portal without an account.
Can vendors register themselves?
Yes. Share the Onboard Hub registration link. You review each submission before it becomes a record.
What is Core IQ?
The AI inside the suite. It researches vendors, runs full reviews that propose register changes for you to confirm, and answers questions over your documents.
Does Core IQ change my records on its own?
No. It proposes changes, and you confirm each one before it is saved.
Which privacy laws do reviews cover?
Reviews apply the framework where you're based, including UK GDPR, EU GDPR and member-state laws, POPIA, LGPD, India's DPDPA, and Canadian, US, Australian, and Singapore law.
Can I keep a record of processing?
Yes. Processing activities record purposes, lawful bases, data subjects, transfers and safeguards, retention, and recipients, linked to the vendors and systems involved.
Can I track AI systems?
Yes. Inventory AI systems with their risk level, lifecycle stage, model, training data, bias assessment, and ethics review, and log AI incidents against them.
How many users can I add?
Up to 15 users on Standard and 25 on Professional. Enterprise has custom limits.
Other modules
Each module shares the same organisation, permissions, and documents.
Cookie Consent Management
Cookie banners, scans, Consent Mode, and consent records for South African sites.
Privacy Policy & Notice Management
POPIA privacy notices and policies, approvals, versions, and the policy widget.
Privacy Rights Automation
Access, correction, and deletion requests with deadlines and workflows.
Website Accessibility
WCAG scans, AutoFix, the accessibility widget, and statements.
Ready to run POPIA and vendor risk in one place?
See the modules that match your programme in a short demo. Plans are billed monthly in rand, excluding VAT.