Your AI reads
the evidence for you.
Your AI checks each control against POPIA, ISO 27001 and PCI-DSS, finds where the evidence lives, and hands you a readiness sheet. We do the remediation and certification that follows.
Cheaper to get compliant than to get caught.
1,727.
security compromise notifications received by South Africa's Information Regulator in 2023/24, up from 590 the year before
Information Regulator (South Africa), Annual Report 2023/24, 2024
What your AI does about it:
It checks each control against your evidence, notes where the proof sits and when it was last tested, and hands you a readiness sheet showing the gaps.
Imagine it. Here it is.
How AI checks your POPIA and ISO 27001 readiness
Watch the AI work through 10 sample controls: what it checks, where it found the evidence, when it was last tested. Ends with a downloadable readiness sheet. Example data, run against your own controls and the sheet is yours.
What we cover
Six disciplines. End to end.
POPIA
POPIA Compliance
Fines run up to R10M per contravention. We audit your data practices, draft consent forms, write processing agreements, set retention schedules, build the breach-notification runbook.
ISO
ISO 27001 Certification
Opens doors that are otherwise closed. Gap analysis against all 93 Annex A controls, risk assessment, policy development, implementation, support through certification.
RISK
Risk Assessment
Information assets identified, threats mapped, likelihood + impact assessed. Ranked risk register that tells you where to spend the security budget first.
POLICY
Policy Development
Policies people actually follow. Information security, acceptable use, incident response, data classification, access control. Plain language, enforceable, framework-aligned.
AUDIT
Audit Preparation
Evidence collection, control testing, documentation review, mock-audit walkthroughs. Your team knows what to expect and what to show. The audit week is calm.
MAINTAIN
Ongoing Management
Compliance isn't a certificate you frame and forget. Annual reviews, control-effectiveness testing, policy updates, awareness refreshers. Someone is watching.
Frameworks
The headline three. Plus everything else IT touches.
Protection of Personal Information Act
POPIA
- ·8 conditions for lawful processing
- ·Information Officer registration with the Regulator
- ·Breach notification as soon as reasonably possible
- ·Data-subject access-request handling
- ·Cross-border transfer adequacy assessments
- ·Operator (processor) agreements required
Stakes
Up to R10M fine or 10 years imprisonment
Information Security Management System
ISO 27001:2022
- ·93 controls across 4 domains
- ·Risk-based approach to security
- ·Statement of Applicability documented
- ·Internal audit programme + management review
- ·Continual improvement through corrective actions
- ·3-year cycle with annual surveillance
Stakes
Increasingly required for tenders and enterprise contracts
Payment Card Industry Data Security Standard
PCI-DSS
- ·12 requirements across 6 objectives
- ·Network segmentation + firewall configuration
- ·Cardholder data encrypted in transit and at rest
- ·Vulnerability management + pen testing
- ·Access control + authentication
- ·Monitoring, logging, incident response
Stakes
Fines from card brands, loss of payment-processing ability
Also covered · gap analysis, remediation, audit support
What we find every time
Five gaps in nearly every audit.
Gap 01
No data-processing agreements with third-party vendors
POPIA non-compliance. Vendors process PI on your behalf without a legal agreement governing how.
Gap 02
Backup tapes stored offsite with no encryption
Physical theft of backups = full data breach. No encryption means no protection if the tapes walk.
Gap 03
No formal access review process
Former employees still have active accounts. Contractors retained access after projects ended.
Gap 04
Incident response plan exists, waiting for its first tabletop
When a breach happens, your team reads the plan for the first time under pressure. That's a draft.
Gap 05
Personal data retention with no defined schedule
You're storing data you're legally required to have deleted. Bigger the breach, longer the tail.
How an engagement runs
Five stages, gap to certificate.
Gap Analysis
Current state against the target framework. Every control evaluated: implemented, partial, or missing. Clear picture of where you stand and how far you need to go.
Roadmap
Prioritised remediation with timelines, effort estimates, dependencies. Quick wins first, structural changes after. You know what costs what.
Implement
We do the work. Policies drafted, controls configured, procedures documented, staff trained. This is where most consultants stop.
Certify
Internal audit to validate readiness. Evidence packages compiled. Mock-audit walkthroughs. We stay in the room and handle the technical questions.
Maintain
Annual surveillance audits, control-effectiveness reviews, policy updates, regulation monitoring. We keep it alive so the certificate doesn't lapse.
Now it's real.
Four things stay true, whatever we build for you.
Your hardware or ours
On your server, on ours, or on a machine in your office running an open model. Your call.
A person approves what matters
Payments, deletions and anything going to a client wait for a yes from you or someone you choose.
Every action logged
You can see what it read, what it did and why, for every task.
Built with POPIA in mind
We set it up the way we set up any system that handles personal information, with the same care our compliance work gets.
POPIA and ISO 27001 questions people ask
What does an AI compliance check actually look at?
It goes through each control in your framework (POPIA, ISO 27001, PCI-DSS), checks whether the evidence exists, where it lives, and when it was last tested. You get a readiness sheet, not a guess.
How long does POPIA compliance take?
A gap analysis takes days. Closing the gaps, from an Information Officer registration to a processing register, usually runs a few weeks depending on how much is missing.
Do we need ISO 27001 if we already have POPIA covered?
Different purposes. POPIA is a legal requirement for any business handling personal information. ISO 27001 is a certification that opens tenders and enterprise contracts. Many of our clients need both.
Can the AI do our compliance work on its own?
No. It reads your evidence and flags gaps fast. Drafting policies, registering with the Regulator and getting through an audit still needs a person, which is what we do after the check.
What is the penalty for a POPIA breach?
Up to R10 million per contravention under section 109, or imprisonment in serious cases. Most fines are avoidable with the basics: an Information Officer, a processing register and a breach-notification plan.
Stop guessing where the gaps are.
See the board.
Free scoping call. We map your current state and hand you a ranked remediation list.