POPIA & privacy
Access control, purpose-aware data handling, auditability, retention thinking and incident readiness.
- Role-based access
- Audit logging
- Data minimisation principles
- Secure hosting considerations
Institutional Compliance Framework
Compliance-aware architecture without pretending software replaces regulation.
We design controls, records, evidence, access and reporting around South African institutional requirements. The system supports the institution; it does not grant accreditation or statutory status.
POPIA privacy controlsQCTO-aware deliveryAudit evidence
Framework overview
Controls, evidence and accountability built into the system design.
QCTO & SETA-aware delivery
Structures for learner, programme, assessment, moderation and evidence records where applicable.
- Qualification structures
- Assessment & evidence tracking
- Practical and workplace records
- Reporting-ready data
DoL / UIF programme records
Structured programme, learner, attendance and outcome data for controlled administration.
- Learner records
- Attendance & outcomes
- Funding-related evidence
- Management dashboards
Audit & verification process
Know what you have before somebody asks for it.
Data capture
Capture from the source with required fields and validation.
Verification
Use system checks and responsible staff review.
Audit trail
Record important changes, approvals and evidence.
Readiness review
Identify missing records, documents and exceptions.
Remediation
Correct gaps and document follow-up actions.
Typical risk register
Examples of the risks good system architecture should reduce.
Likelihood is not a guarantee; actual risk depends on the institution, configuration and operating practices.
| ID | Risk | Impact | Typical control |
|---|---|---|---|
| R-01 | Unauthorised access | High | Role-based access, authentication, audit logs |
| R-02 | Incomplete learner records | Medium | Required fields, validation and exception reporting |
| R-03 | Data breach | High | Secure hosting, access controls, monitoring and incident process |
| R-04 | Incorrect regulatory reporting | High | Data validation, approvals and review workflows |
| R-05 | Loss of evidence trail | High | Backups, versioning, logs and controlled retention |
Compliance documentation
Download the existing ArtScience compliance pack for governance principles, controls and audit-readiness documentation.
Regulatory disclaimer
ArtScience software can support evidence, workflow and control requirements. It does not certify an institution as POPIA compliant, grant DHET registration, grant QCTO accreditation, replace an assessment centre, or remove the institution’s obligation to satisfy programme-specific knowledge, practical, workplace and external-assessment requirements. Regulatory and legal advice should be obtained from the appropriate authority or qualified adviser where required.