technical·Source review required
Data handling and POPIA review surface
Map the product's data responsibilities without presenting a technical page as legal advice.
Last reviewed: 21 October 2026
Legal review required
The final operator/responsible-party wording, retention periods, cross-border processing and data-subject rights must be reviewed against current POPIA guidance and the actual provider contracts.
| Data area | Product purpose | Review question |
|---|---|---|
| Client and customer details | Create, send and track documents | What notice and lawful basis applies? |
| Payment events | Reconcile payment status | Which gateway records are authoritative? |
| Medical or legal fields | Support specialist workflows | Is the field necessary, protected and access-controlled? |
| Uploaded evidence | Support an invoice or workflow | How long is it retained and who can access it? |
The public compliance page should link to the privacy policy, DPA and support path. It should not expose internal identifiers, customer examples or provider secrets.