What a POPIA-compliant LMS actually needs, and how to check a vendor

A learning management system holds more personal information than most organisations realise: names and contact details, sometimes identity numbers, assessment results, written answers, uploaded evidence of workplace learning and records of who completed what. In South Africa, all of it falls under the Protection of Personal Information Act (POPIA).

Vendors often answer that their platform is "POPIA compliant". That phrase deserves a closer look, because it misplaces the responsibility.

POPIA in brief

POPIA (Act 4 of 2013) regulates how personal information is processed. Most of its provisions took effect on 1 July 2020, with a one-year grace period that ended on 1 July 2021. It is enforced by the Information Regulator.

The Act distinguishes the responsible party, the organisation that decides why and how personal information is processed, from the operator, a service provider that processes it on the responsible party's behalf. When you run training on a vendor's LMS, you are normally the responsible party and the vendor is your operator.

Lawful processing rests on eight conditions: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.

Why no LMS is "POPIA certified"

POPIA does not certify software products, and the first condition, accountability, sits with the responsible party. A platform cannot be compliant on your behalf. What it can do is give you the controls, contracts and evidence that make your obligations practical to meet. Treat any "POPIA certified" badge with caution and ask what sits behind it.

The checklist

1. Where the data lives, and whether it leaves South Africa

Section 72 of POPIA limits transfers of personal information to a third party in a foreign country to specific grounds, such as a recipient bound by adequate data protection law or a binding agreement, or the data subject's consent. Ask where production data, backups and logs are stored, and which other services touch learner data: email delivery, video hosting, analytics and AI providers are common routes out of the country.

2. A written operator agreement

Section 21 requires a written contract between you and your operator that obliges the operator to establish and maintain the security measures POPIA requires. It should also cover confidentiality, sub-processors, breach notification, assistance with data subject requests and what happens to the data when the contract ends.

3. Security safeguards you can check

Section 19 requires appropriate, reasonable technical and organisational measures. Ask for specifics rather than assurances:

• Encryption in transit and at rest
• Role-based access, with multi-factor authentication for administrators
• Audit logs of who viewed or changed learner records
• How quickly security patches are applied to the platform and its framework
• Backups, and evidence that restores are tested
• Independent security testing, and how findings are fixed

4. A breach process with clear timelines

Under section 22, the responsible party must notify the Information Regulator and affected people as soon as reasonably possible after a security compromise. You can only do that if your operator tells you quickly. Agree in writing how and when the vendor will notify you, and what information they will provide.

5. Collect less

Processing must be adequate, relevant and not excessive. Question every field on the enrolment form. Do you need full identity numbers, or would an employee number do? A public certificate verification page should confirm that a certificate is genuine, not publish a learner's personal details.

6. Retention and deletion

Records should not be kept longer than necessary for their purpose, subject to legal retention requirements. Check whether retention periods can be configured, how records are deleted and how you get a complete export when the contract ends.

7. Learner rights

Learners may ask what information you hold about them and ask for corrections. Administrators should be able to find, export and correct a learner's records without a support ticket to the vendor.

8. AI features

If the platform uses AI to give feedback or score answers, ask where the text is processed, whether it is used to train anyone's models, and who makes the final decision. Section 71 of POPIA restricts decisions with legal or substantial effects that are based solely on automated processing, so results that affect certification should be reviewed by a person.

Questions to put in your RFQ or tender

1. In which country and data centre region are production data, backups and logs stored?
2. Which sub-processors handle learner data, and in which countries?
3. Will you sign a written operator agreement under section 21 of POPIA?
4. How and within what time will you notify us of a security compromise?
5. Which roles exist in the platform, and is multi-factor authentication available for administrators?
6. Are changes to learner records logged, and can we export the audit trail?
7. Can we configure retention periods and delete records on request?
8. What does a certificate verification page show to the public?
9. Is learner text sent to an AI provider, and is it used for model training?
10. What do we receive at the end of the contract, and in which formats?

How AINEXIM approaches it

Our learning management system is built to support these obligations rather than to claim them away. Client platforms can be hosted in the AWS Africa (Cape Town) region, access is role-based with audit trails, AI-assisted feedback is reviewed by instructors who keep the final decision, and learner content is not used to train external models. Every engagement includes an operator agreement and an exit plan with your data in open formats.