Vetting a provider to write your POPIA-compliant staff data policy

You've just had your first data breach scare—a contractor accessed employee records they shouldn't have, and your compliance officer mentioned POPIA. Now you need someone to write a staff data policy fast, but you don't know how to judge whether a consultant actually understands data protection or is just repackaging templates. Here's how to vet them properly.

Check their data protection credentials upfront

Start by asking directly: are they registered with a professional body that covers data protection consulting? In South Africa, consultants working on POPIA compliance often hold qualifications from bodies like SSOZI (Systems Security and Online Zone Institute) or similar data protection associations. Some hold IAPP (International Association of Privacy Professionals) certifications. Ask for proof. This isn't a dealbreaker if they don't, but it tells you they've invested in staying current with framework changes.

More important: ask them to explain what POPIA actually requires. Not the long version—just their 30-second summary. A competent consultant will mention consent, lawfulness, collection limitation, and your obligations as a responsible party. Someone who launches into selling their service rather than explaining the law is a red flag.

Request references from similar-sized businesses

Ask for at least two client references—ideally businesses close to your headcount. Call them. Don't ask generic praise questions. Instead, ask: "Did they ask you lots of questions about how you actually handle staff data, or did they mostly talk about their process?" "How many rounds of revision did it take before the policy fitted your business?" "Have you had any compliance queries from staff or regulators since they finished the work?"

A solid consultant will have asked about your specific data flows—which systems hold employee records, who accesses them, how long you keep them, whether you share data with third parties like payroll providers. If the consultant skipped those questions, they're writing generic copy, not a workable policy.

Dig into their understanding of your actual obligations

During your initial conversation, walk them through a realistic scenario: an employee's contact details are on your shared drive, your accountant needs tax data from your HR file, and a recruitment agency rings asking if you've worked with a candidate before. Ask how your data policy should handle each. A strong consultant will explain the consent angle, the lawfulness requirement, and what your policy needs to say to protect the business. They'll also flag which questions only you can answer (like: do you have consent from employees to share their info with your accountant?). Someone who promises a one-size-fit-all answer is cutting corners.

Verify they know your operational reality

Before they start drafting, they should spend time understanding how your business actually works. That means asking about your tech stack—do you use cloud HR, are spreadsheets still in play, who has admin access?—and your team structure. Do you have an IT person, an office manager, a people person? POPIA compliance isn't theoretical; the policy has to land with real people in your business. A consultant who digs into those details is more likely to produce something usable than one who just pumps out a 20-page document.

Also ask: will they deliver a policy document, training materials for your team, or both? If they're not offering to brief your staff on what the policy means and how to follow it, the policy will sit in a drawer. The best consultants build in a short hand-over session so your team understands their role in data handling.

Look for someone who stays in touch

Data protection rules shift. Regulations often adjust annually, and POPIA guidance from the Information Regulator gets refined. Ask whether the consultant offers a review service or sends updates. You don't need an ongoing contract, but knowing they'll flag material changes is worth paying a bit more for. Some also offer a short "help line" in year one if your team has questions as they embed the policy.

When you're ready to move forward, Strove's verified HR consultants can be filtered by expertise—look for those who've listed POPIA or data protection policy work in their profile, check their reviews for mentions of compliance work, and message them directly with your brief to see how thoughtfully they respond.