Inspections are announced, not a surprise

POTRAZ has said it will begin data protection inspections and assessments on 1 September 2026, on a risk-based approach that starts with named priority sectors — financial institutions, insurers, local authorities, healthcare, mining, religious organisations, education, government and NGOs. Inspections are announced, not raids: the regulator expects you to be ready, and readiness is what they are measuring.

The licence is the first question

Before anything else, an inspector will ask whether you are licensed as a data controller. Processing personal data without a licence is the clearest and easiest failure to establish, because the licence is either on record with POTRAZ or it is not. If you are not licensed, the rest of the inspection is largely about the gap, not your good practice.

The DPO appointment is the second

The next question is whether you have appointed a Data Protection Officer, and whether that appointment is documented. An informal arrangement — "someone in IT handles it" — is not an appointment and will not survive scrutiny. The inspector wants to see who is accountable, named, in writing.

The practical evidence comes third

Once licensing and the DPO are confirmed, the inspector works through the practical evidence: your processing register (what data you hold, why, and where it goes); privacy notices as actually issued to people, not a draft in a folder; consent records where consent is the lawful basis; a retention schedule showing you do not keep data forever; access controls on systems that hold personal data; a breach register, even if empty; and records that staff have been trained.

What to do this month

This month, confirm your licence status in writing, put the DPO appointment on paper if it is not, and start the processing register. Those three move you further than any policy document.

Sources: Cyber and Data Protection Act 5 of 2021 [Chapter 12:07]; Statutory Instrument 155 of 2024; POTRAZ inspection announcement (1 September 2026).

This is general guidance, not legal advice. Your licence category is determined by POTRAZ on assessment of your application.