The Scenario
A South African healthcare provider processes patient data across 12 clinics. They have never formally assessed their POPIA compliance. The Information Regulator has started issuing enforcement notices to similar organisations. The board wants an honest assessment.
The Brief
Conduct a POPIA compliance gap assessment. Evaluate current practices against POPIA requirements and produce a prioritised remediation roadmap.
Deliverables
- A compliance assessment matrix: POPIA Condition × Current Practice × Gap × Risk Rating (at least 8 conditions)
- A data flow map showing where personal information is collected, processed, stored, and shared
- A prioritised remediation roadmap: Critical (0-30 days), Important (30-90 days), Maintenance (ongoing)
Submission Guidance
POPIA has 8 conditions for lawful processing. Do not just list them — assess each against what the healthcare provider actually does (invent realistic current practices).
Submit Your Work
Your submission is graded against the rubric on the right. If you pass, you get a public Badge URL you can share on LinkedIn. There is no draft save, so work offline first and paste your finished response here.