Free and open source · Law current to 18 October 2026
Ship South African apps
that respect personal information
POPIA Kit plugs into Claude, Cursor, Lovable and the other AI tools you build with. It catches the common leaks before they ship and drafts the paperwork your Information Officer needs.
Get the kit on GitHubMIT and CC BY 4.0 · 43 scanner rules · 8 AI tools · No account needed
- HighSEC-004s19
Table created without row level security
supabase/migrations/init.sql:2
- HighCON-002s11, s69
Pre ticked marketing checkbox
src/components/SignupForm.tsx:18
- HighCON-001s18, s69
Trackers load before consent
index.html:5
Fix · SEC-004
- create table profiles (id, email);- -- no policies+ alter table profiles+ enable row level security;+ create policy "own row"+ on profiles+ using (auth.uid() = id);
POPIA Kit in 73 seconds
Works with the tools you already use
- Claude
- Claude Code
- Cursor
- Lovable
- OpenAI Codex
- GitHub Copilot
- Windsurf
- Gemini
- ChatGPT
- any MCP client
Most POPIA problems start in the codebase
R10 million
Maximum administrative fine under POPIA
Source: POPIA s109
8,000+
Security compromise notifications to the Information Regulator since POPIA commenced
Source: Information Regulator briefing, 31 Aug 2026
1 April 2025
Since then, breach reports must go through the Regulator's eServices portal
Source: Information Regulator fact sheet, Aug 2025
Most leaks aren't legal failures. They're a table without row level security.
Why POPIA Kit
Privacy work that fits how you already build
Benefits
Catch exposures before they ship.
Open tables, leaked keys, trackers before consent and pre ticked boxes, each mapped to the POPIA section.
Fix with drop in components.
Consent banner, marketing opt in, privacy centre and Supabase migrations ready for React and Lovable.
Paperwork in minutes, not weeks.
Answer about 40 questions and get a draft privacy notice, cookie notice, ROPA and PAIA manual for review.
Stays inside your tools.
One rules file for Cursor, Codex, Copilot, Windsurf, Gemini and Lovable. A full skill for Claude. An MCP server for any agent.
How it works
Three steps from install to Information Officer
- 01
Install
Copy one rules file into your AI tool, or add the full skill to Claude.
.cursor/rules/popia.mdc AGENTS.md .claude/skills/popia-compliance/ - 02
Scan
Run one command. Every finding cites the POPIA section and how to fix it.
terminaluvx popia-kit scan .34 findings · 1 critical · 10 high - 03
Fix and document
Drop in the components and generate drafts for your Information Officer.
Privacy noticeDraft Cookie noticeDraft ROPADraft PAIA manualDraft
What it checks
43 rules across eight areas of the Act
| Check | Example |
|---|---|
| Access control and secrets s19 | Tables without row level security, service keys in client code |
| Consent, trackers and cookies s11, s18 | Analytics scripts that load before the visitor agrees |
| Direct marketing opt in s69 | Pre ticked boxes and opt out only newsletter signups |
| Special personal information and biometrics s26, s27 | Health, religion or face data stored without a lawful basis |
| Children's information s34, s35 | No age check or guardian consent on signup |
| Cross border transfers and operators s20, s21, s72 | Data sent to offshore vendors with no operator agreement |
| AI and automated decisions s71 | Credit or hiring decisions made by a model with no human review |
| Notices, PAIA manual and data subject rights s18, s23, s24 | No privacy notice, no way to request or correct data |
Install
Pick your tool. Paste one line.
No clone, no account, no API key. Runs on your machine.
uvx popia-kit scan .No uv? pipx run popia-kit scan . or npx -y github:VenusOne-Lee/popia-compliance scan . Needs Python 3.8 or newer.
Download the repo and add it as a skill, or copy it into your skills folder.
cp -r popia-compliance .claude/skills/popia-compliance/Tested in the open
Open source
Built in the open. Kept current by the people who use it.
Legal reviewer wanted.
We're looking for South African attorneys with POPIA experience to review legal content. Small, focused reviews. You choose the scope. Credited by name. A review is not legal advice to users and creates no client relationship.
FAQ
Questions builders ask
Yes. Code is MIT and the guidance is CC BY 4.0. Use it in client work and credit Venus One and contributors.
Run one command with uvx, pipx or npx. Nothing to clone. It needs Python 3.8 or newer.
No tool can. It finds common problems, helps you fix them and drafts documents for review. Compliance also depends on your processes and contracts.
Claude, Claude Code, Cursor, Lovable, OpenAI Codex and other AGENTS.md tools, GitHub Copilot, Windsurf, Gemini and ChatGPT. Any MCP client can run the scanner.
No. It runs locally and makes no network calls.
It reflects POPIA and the Regulations as amended on 17 April 2025, current to 18 October 2026. A monthly watch flags Regulator updates.
No. It is engineering guidance. The project has no legal reviewer yet. Speak to a qualified privacy attorney for high risk processing.
Venus ARC (Pty) Ltd, trading as Venus One, in Centurion, Gauteng, with contributors.
Disclaimer
Engineering guidance, not legal advice.
POPIA Kit has no legal reviewer yet, and a clean scan is not a compliance certificate. Speak to a qualified South African privacy attorney before processing special personal information, children's information or biometrics, or before making automated decisions about people.
Start with one scan. Fix what it finds.
Free, open source and runs on your machine.
Get the kit on GitHubNeed hands on help? Venus One reviews systems for South African firms