How to choose a consultant for genuine POPIA compliance

You've just realised your business handles personal data—customers, employees, suppliers—and POPIA applies to you. The compliance gap feels real now. But not every consultant who claims POPIA expertise will match your company's size, risk profile or budget reality. Picking one demands focus on a few hard criteria that actually separate the capable from the chaff.

Know what you're really asking them to do

Before you vet candidates, clarify your own scope. Are you starting from scratch with no data audit done? Do you already know where sensitive data lives but need a compliance roadmap? Or is this mostly about appointing and coaching an Information Officer? The answer shapes who you need. A consultant strong at large-scale data mapping audits is not necessarily the right fit if your ask is lightweight governance setup and staff training. Some firms specialise in pre-emptive compliance for small businesses; others excel at remediation after a breach or regulator inquiry. Honesty about what you actually need—and what you can afford to resource internally—will filter your list faster than any CV will.

Verify domain depth, not just certifications

Look for consultants with direct, recent experience working on POPIA projects in South Africa. This is not the same as holding a privacy certification or having advised on GDPR abroad. Ask specifically: have they conducted data mapping exercises for companies in your industry? Have they drafted or reviewed Data Processing Agreements, consent frameworks, or breach response plans? Have they dealt with Information Officer appointments or worked through a regulator response? A consultant who can cite three or four real examples—anonymised, of course—in your space is more valuable than one with a long list of overseas credentials. Check they're registered with relevant bodies if they claim to operate as Certified Information Privacy Professionals or under a formal cyber or compliance banner; ask for the registration number. Equally, ask how they stay current: POPIA interpretation and enforcement are still evolving, so you want someone actively tracking guidance from the Information Regulator and learning from peers.

Assess how they'll work with your team

POPIA compliance is not a one-off report you buy and shelve. It requires your business to embed practices—how you collect consent, handle subject access requests, manage vendor relationships, respond to breaches. The consultant's style matters. Will they sit with your leadership and IT team to understand your actual systems, or will they send a questionnaire and write generic recommendations? Do they plan to train your people or leave compliance as their exclusive domain? Will they be available for follow-up questions, or does the engagement end on delivery? A good fit is someone who works collaboratively, explains trade-offs in plain terms, and hands responsibility back to your business—not someone who positions themselves as a permanent gatekeeper. Ask how they'd handle a live data subject request or breach notification during the engagement; their answer will tell you whether they see themselves as advisors or fixers.

Cost and timeline realism

POPIA consulting spans a huge range—from a few thousand rand for a lightweight compliance check to six figures for a full-scale enterprise remediation. The price should reflect the size of your data footprint, the number of processing systems, staff headcount and your starting point. Be wary of quotes that seem too cheap (you're getting a template) or that promise certainty on timelines without having reviewed your environment first. A reputable consultant will spend time scoping before quoting. They'll also be transparent about what happens after: do they charge for implementation support, annual check-ins, or breach response? Will they hand you a playbook you can work from, or are they billing hourly for every question?

When you're ready to shortlist, ask candidates for references from similar-sized businesses in your sector. A consultant who has guided three or four companies through genuine compliance journeys will give you more confidence than generalist credentials alone. Strove's verified consultant profiles can help you compare backgrounds, read client feedback and request quotes from multiple candidates at once—a good way to sense which ones understand your actual situation versus those pitching a standard package.