Across South Africa, many organisations are racing to prove their compliance with the Protection of Personal Information Act (POPIA). For some, this has meant hurriedly adding tick boxes to websites, forms, and contracts — believing that a signed consent equals compliance.

But here’s the truth: ticking a box doesn’t make you compliant. Consent is only one of eight lawful grounds for processing personal information under POPIA — and in many cases, it’s not the most suitable one.

The Problem with Relying on Consent

Consent might sound like the safest route, but it’s not always the most stable legal foundation. Why? Because consent can be withdrawn at any time. If your business relies solely on consent, that withdrawal can immediately disrupt your operations — especially if personal information is essential to providing your service.

In many everyday business relationships, consent isn’t freely given in the true legal sense. For example, an employee cannot realistically “refuse” to provide personal information for payroll processing, and a customer applying for vehicle finance can’t expect approval without supplying the required data. In these scenarios, processing is better justified under other lawful grounds — such as performance of a contract or compliance with a legal obligation.

Overusing consent can actually signal a misunderstanding of POPIA’s broader compliance framework. It shows a focus on paperwork, not principles — and regulators are paying attention to that distinction.

True POPIA Compliance Goes Beyond Permission

POPIA compliance is about accountability and responsibility, not just permission. It requires businesses to handle personal information lawfully, fairly, and transparently. This means:

• Collecting only what’s necessary for the specific purpose.
• Securing information against loss, damage, or unauthorised access.
• Keeping data accurate and up to date.
• Allowing individuals to access, correct, or delete their personal information.

True compliance is not a once-off exercise — it’s an ongoing commitment to data stewardship and ethical information management. It’s about building systems and policies that respect individuals’ privacy rights while supporting operational efficiency.

The Takeaway

Consent is a tool, not a shield. It’s one mechanism within a broader legal framework — not the framework itself.

A responsible organisation understands all the lawful bases for processing personal information and applies the one most appropriate to each situation. By doing so, businesses move beyond mere box-ticking to real compliance — grounded in understanding, accountability, and trust.