POPIA and your filing room: five questions auditors actually ask
Retention schedules, access logs and the paper nobody remembers. What inspection readiness looks like in practice.
Most conversations about POPIA happen in front of screens. The awkward ones happen in front of shelves. Here are the five questions we hear auditors ask about physical and digital records, and what a good answer looks like.
1. What do you hold, and where?
Not a philosophy, an inventory. Which record types, which locations, which systems. If the answer lives in one person’s memory, it is not an answer.
2. Why are you still holding it?
Every record class needs a retention rule, and the rule needs a reason: statutory, contractual or operational. Keeping everything forever is not caution. Under minimality it is exposure.
3. Who accessed it, and when?
For digital records this is an access log. For paper it is a chain of custody. Either way, the question is answered by a system, not a recollection.
4. Can you find it under pressure?
A data subject request has a clock on it. Retrieval measured in seconds changes the character of the whole exercise.
5. How does it end?
Records need an end of life: a destruction date, an approval, a certificate. Disposal is the most neglected stage of the lifecycle and the first one an inspector asks about.
None of these questions is hard on the day you design for them. All of them are hard the week the inspection letter arrives.