12-Month Comprehensive

Cultural Integration & full audit defense

M1:

• Appoint & Register.

M2:

• Deep data mapping
• Operators register
• Data‑flow diagrams.



M3–M4:

• Policy development & approvals (incl. POPI Management, Risk Policy, Cookie/Website privacy, Marketing governance).

M5:

• Multi‑audience training
• Responsibilities matrix.

M6–M7:

• Implementation sprints
• DSAR portal/form
• Breach drill
• Evidence pack.

M8:

• Internal assessment
• Final Compliance Report
• Annual refresh calendar.