Step one: establish you are a controller
Before anything else, confirm that your organisation is a data controller — that it decides the purposes and means of processing personal data. Most organisations are. The classification decides who must be licensed, who appoints the DPO, and who carries the responsibility.
Step two: map what you actually process
Map what you actually hold: staff records, customer or member data, supplier contacts, CCTV, biometrics, anything in the cloud. The output is the processing register — what data, why you have it, where it goes, who can reach it, and how long you keep it. This register is both the foundation of the application and the document an inspector will ask to see first.
Step three: fix the obvious gaps before applying
Fix the obvious gaps before you apply, not after. Issue privacy notices where you collect data. Put consent on record where consent is your basis. Tighten access controls. Set a retention schedule. Put processor agreements in place with the suppliers who handle data for you. An application filed over unresolved gaps is an inspection waiting to fail.
Step four: prepare and file with POTRAZ
Prepare the licence application — what you process, why, how you protect it, and who your DPO is — and file it with POTRAZ. Keep the whole pack: the register, the policies, the signed forms, the filed application. That pack becomes your inspection file, and having it ready is most of the work of an inspection.
Step five: keep the position alive
Compliance is not a one-off. As you add systems, vendors and datasets, update the register and the licence position. A register that is a year old at inspection is evidence of a programme that stopped, not one that is running.
Sources: Cyber and Data Protection Act 5 of 2021 [Chapter 12:07]; Statutory Instrument 155 of 2024; POTRAZ inspection announcement (1 September 2026).
This is general guidance, not legal advice. Your licence category is determined by POTRAZ on assessment of your application.