Compliance
POPIA compliance checklist for South African lenders
POPIA applies to every business that processes personal information in South Africa — and for lenders, the exposure is concentrated: client financial data, credit records, KYC documents. Penalties run to R10 million per infringement, with criminal prosecution possible in severe cases.
The checklist
1) An Information Officer appointed and registered. 2) Verifiable consent records. 3) Field-level access logging on personal information. 4) A DSAR workflow meeting the 21-business-day deadline. 5) Retention schedules and deletion enforced. 6) Anomaly detection on access patterns. 7) A documented breach response. 8) Tracked staff training.
The reality for spreadsheet lenders
Most of these controls can't be enforced on a workbook. The audit trail is assembled retroactively from inboxes; consent is a folder of forms; access logging doesn't exist.
System-enforced compliance
A platform enforces the controls continuously: field-level logging on every PII access, DSAR workflows with SLA tracking, anomaly detection, immutable audit history. Compliance stops being a project and becomes a property of the system.
Run the 12-point readiness check
A scored report naming your compliance gaps — and the control that closes each.
Common questions
Asked straight.
Yes — every responsible party must appoint an Information Officer and register them with the Information Regulator.
Keep reading
Compliance
DSAR workflow: meeting the 21-business-day deadline
When a data subject asks what personal information you hold on them, POPIA gives you 21 business days to respond. For a lender running on spreadsheets, assembling that answer is a scramble — if it's even possible.
Compliance
NCA affordability assessment: what South African credit providers must document
Under the National Credit Act, a credit provider must genuinely assess whether a consumer can afford the credit before granting it. Courts have been clear: the affordability assessment is a substantive obligation, not paperwork.
The category
What is a capital intermediary platform?
The lender industry built software for the lender that funds its own book. It never built software for the company that sources the deal and funds it with someone else's capital. That company is a capital intermediary — and the gap in software is exactly what Apex was built to fill.