POPIA and the Information Regulator
SassaCheck handles personal information under South Africa's Protection of Personal Information Act (POPIA).
What POPIA means for SassaCheck
POPIA is the law that controls how we collect, use and keep personal information. SassaCheck is an independent SRD status checker. We are not SASSA and not a government website. We cannot approve, decline or change any grant, and we cannot change your banking details.
We process personal information only for the reasons on this page. This page is the technical annex to our privacy policy. It explains our lawful basis, our data flow, how long we keep information, which sub-processors we use, cross-border transfers, your rights and how to contact the Information Regulator.
Registration details
We do not publish our operator, registration or Information Officer details on this site.
| Detail | What we publish |
|---|---|
| Operator legal entity | Operator, registration and Information Officer details are available on request. Contact us at hello@sassacheck.org.za. |
| CIPC registration number | |
| Information Regulator registration number | |
| Registration certificate | |
| Information Officer | |
| PAIA manual | The PAIA manual is available on request. Contact us at hello@sassacheck.org.za. |
What is our lawful basis for processing?
We rely on consent for the status check and for replying to your email, and on legitimate interest for abuse prevention and security logging.
| Processing | Personal information | Lawful basis under POPIA section 11 |
|---|---|---|
| SRD status lookup | ID number, cellphone number | Consent, section 11(1)(a). You submit each request using Check my status after reading the consent notice. |
| Abuse prevention | Keyed hashes of IP address and applicant ID | Legitimate interest, section 11(1)(f). |
| Security logging | Timestamp, path, IP address | Legitimate interest, section 11(1)(f). |
| Replying to you | Email address, message | Consent, section 11(1)(a). |
| Google AdSense advertising | IP, device and ad-interaction data; cookies or similar technologies may be used | See the privacy and cookie policies for provider details and advertising choices. |
What happens to your ID number and cellphone number?
We do not save raw ID numbers, cellphone numbers or status results in our application database. Keyed security hashes, request counters and operational logs are retained separately; see our data-handling explanation.
The steps are:
- Your browser sends your ID number and cellphone number over HTTPS to our Johannesburg-hosted Google Cloud Run API.
- That service passes them to SASSA's public SRD status service, the same one behind srd.sassa.gov.za.
- SASSA's answer comes back to the service, and straight to your screen.
- The form holds the result in the current page memory. It does not write the result to cookies, local storage or session storage. Reloading or closing the page clears that page state; browser history, autofill and device behaviour remain under your control.
- The home-page checker processes your ID number and cellphone number through our server to retrieve your result from SASSA. It does not save the raw ID, phone number or result in its application database. Separate security counters and hosting logs are retained as described in our privacy policy.
Raw results are not saved in our application database. The result is displayed in current-page memory; security counters and operational logs have separate retention periods.
How long do we keep information?
We keep only the minimum needed for security and for replying to you, and we delete it on the schedule below.
| What | Why | How long | How it is deleted |
|---|---|---|---|
| Status check request body: ID number and cellphone number | To pass your request to SASSA | Not persisted in the application database | Held in memory only for the request. Not written to storage. |
| Result in your browser | To show you the answer | Until you close the tab | The form holds the result in the current page memory. It does not write the result to cookies, local storage or session storage. Reloading or closing the page clears that page state; browser history, autofill and device behaviour remain under your control. |
| Keyed, one-way hashes of the IP address and applicant ID, with request counters | Rate limiting, so nobody can use this tool to guess other people's ID numbers | Counters expire after 10 minutes; Firestore TTL deletion happens asynchronously after expiry. | Automatic TTL cleanup after expiry; deletion is not immediate. |
| Operational hosting logs, including connection metadata and IP addresses | Security and uptime | 30 days for the default operational log bucket | Retention is applied by the hosting provider. Contact us about a specific request. |
| Administrative audit logs (Google Cloud) | Records of administrative actions, separate from status-result storage | 400 days in the required audit-log bucket | Managed by Google Cloud retention controls. |
| Anything you email us | Replying to you | For handling the enquiry and any applicable recordkeeping obligations; contact us to request deletion. | Email hello@sassacheck.org.za to request deletion. |
| Google AdSense advertising data | Advertising, measurement and fraud prevention | Managed by Google and its partners; no local retention period is asserted here | Use Google privacy and advertising controls; see our cookie policy. |
Which sub-processors do we use?
We use a small set of service providers to run the site and the status check.
| Sub-processor | What it does | What it sees |
|---|---|---|
| Cloudflare | DNS and, when enabled, proxy security/content delivery | Connection metadata for requests to our site, such as IP address, requested URL and browser details. The current checker calls Google Cloud Run directly, so its lookup request does not pass through the Cloudflare website proxy. We do not instruct it to keep your ID number or cellphone number. |
| Google Cloud South Africa | Hosts the status check service | The request body when a status check runs, including your ID number and cellphone number, so that the request can be passed to SASSA. We do not log the request body. |
| Firebase Hosting (Google) | Serves the pages of this site | The request for the page, including your IP address and browser details. It does not receive your ID number or cellphone number from the status check form. |
| Google Fonts | Font delivery | Not used at launch. If we add it, this page will be updated before it goes live. |
Do we send personal information outside South Africa?
Some of our service providers may process personal information outside South Africa.
Google Cloud South Africa is the region we use for the status check service. Cloudflare and Firebase Hosting use global networks and may process data in more than one country.
Where a transfer outside South Africa is necessary, we rely on section 72 of POPIA. We do not publish a fixed country list because providers can change their processing locations. You can ask us for the current list at hello@sassacheck.org.za.
Google Fonts is not used at launch, so it does not process any personal information for this site.
What are your rights under POPIA?
You have the right to know what personal information we hold, to ask for a copy, to ask us to correct or delete it, and to complain to the Information Regulator.
- Right to be notified. We tell you what we do with your information on this page and in the form.
- Right of access. Email hello@sassacheck.org.za to ask for a copy of the personal information we hold about you.
- Right to correction. Email hello@sassacheck.org.za to ask us to correct information that is wrong.
- Right to deletion. Email hello@sassacheck.org.za or use our delete my data page. We keep very little, so we can usually delete it quickly.
- Right to object. Email hello@sassacheck.org.za to object to processing based on legitimate interest.
- Right to complain. You can complain to the Information Regulator at https://inforegulator.org.za.
We reply within 2 business days.
How do you contact the Information Regulator?
The Information Regulator of South Africa is the body that oversees POPIA.
Website: https://inforegulator.org.za. Use the contact details on its website to call, email or complain.
You can also contact us first at hello@sassacheck.org.za. We reply within 2 business days.
Frequently asked questions
The raw lookup is not saved in our application database. Security hashes and logs have the retention periods listed above. Google AdSense processes advertising data separately; there is no separate Google Analytics tag.
Does SassaCheck store my ID number?
The form holds the result in the current page memory. It does not write the result to cookies, local storage or session storage. Reloading or closing the page clears that page state; browser history, autofill and device behaviour remain under your control.
Is SassaCheck registered with the Information Regulator?
SassaCheck is registered with the Information Regulator of South Africa. We do not publish the registration number on this site. Operator, registration and Information Officer details are available on request. Contact us at hello@sassacheck.org.za.
What lawful basis do you use?
We use consent for the status check and for replying to your email. We use legitimate interest for abuse prevention and security logging. See the lawful basis table above.
Do you use cookies or analytics?
The form holds the result in the current page memory. It does not write the result to cookies, local storage or session storage. Reloading or closing the page clears that page state; browser history, autofill and device behaviour remain under your control.
How do I delete my data?
Email hello@sassacheck.org.za or use our delete my data page. We keep very little, so we can usually delete it quickly. We reply within 2 business days.
Who do I contact if I have a POPIA complaint?
Email hello@sassacheck.org.za first. You can also complain to the Information Regulator at https://inforegulator.org.za.
Sources
These are the sources we used for the POPIA facts on this page.
- Protection of Personal Information Act 4 of 2013 (POPIA), sections 11, 14 and 72. Available via the Information Regulator at https://inforegulator.org.za. Checked 29 October 2026.
- Information Regulator of South Africa. https://inforegulator.org.za. Checked 29 October 2026.
If any of these links no longer work, tell us at hello@sassacheck.org.za and we will fix it.
Last reviewed: 29 October 2026
Your ID number and cellphone number are sent over HTTPS through our server to SASSA to retrieve your status. Our checker does not save the raw ID number, cellphone number or result in its application database, and its application logging code does not record those values. The result is held in the current page memory, without saving it to cookies, localStorage or sessionStorage. For rate limiting, keyed hashes of your IP address and applicant ID are stored with request counters; their expiry is set to 10 minutes after an allowed request, and Firestore deletes expired records asynchronously. Google Cloud request logs can contain your IP address and connection metadata: the default operational log bucket retains records for 30 days, while the separate administrative audit log bucket retains records for 400 days. These audit logs are administrative records, not a 400-day database of status results. Google AdSense may use cookies and process IP, device and ad-interaction data; our code does not send status-form details or results to AdSense. We do not use a separate Google Analytics tag. See our Privacy Policy for details.
See the SASSA contacts page for current official guidance.