Enternovate Open · Gavaza
Privacy law becomes checklists, not lawyers.
If you hold personal information, POPIA applies to you. Gavaza guides you through all 8 conditions. It scores where you stand. It generates the PAIA manual, privacy policy, records of processing and breach register you need to prove compliance.
v0.1.0 · releasedMITPython 3.11+open-core → Gavaza suite
Compliance you can prove.
Tenders and enterprise clients increasingly ask for POPIA proof. Gavaza turns the regulation into a repeatable process. Assess, remediate, document and prove it without a compliance department.
Modelling the 8 conditions
Accountability, processing limitation, purpose, further processing, quality, openness, security safeguards and data subject participation. Each condition has a plain-language checklist.
Assessment engine
Answer the questionnaire once. Gavaza scores every condition from 0 to 100, grades the company from A to F and lists the remediation priorities.
PAIA manual generator
Gavaza fills a section 51 manual from your config. The manual covers purpose, company details, Information Officer, records held, request procedure, fees, refusals and contact.
Privacy policy generator
It covers who we are, what we collect, why we collect it, sharing, security, retention, your rights and contact. The text is POPIA-aware. Adapt it and publish it.
Records of processing
A register of every processing activity. It lists purpose, data subjects, categories, retention, lawful basis and sharing in a ready-to-maintain table.
Breach register
A CSV breach register supports section 22 notification preparation. POPIA requires notification as soon as reasonably possible, subject to the Act. Review the circumstances and notification duties with your legal adviser.
Build your evidence pack.
$ gavaza init --name "Acme (Pty) Ltd" --reg 2025/000000/07 --email info@acme.co.za
$ gavaza assess --interactive
$ gavaza generate --docs all --out ./compliance
$ gavaza report --format html
$ gavaza breach add --description "..." --risk high
v0.1.0 includes init, assess, generate (paia / privacy / register / all), report (json/md/html), breach add / list / timeline and the conditions reference. Generated documents are starting points. Have a professional review them before filing.
One part of a connected stack.
Xavani drives it
Xavani runs the assessment, generates the pack and files the breach from one request.
Feeds the constellation
Gavaza stores compliance evidence in the Nyarhi knowledge graph. Gaps appear in your Mhangani audit trail.
Open-core
The free local toolkit also comes as the Gavaza commercial suite. ComplyHub, IncidentDesk and VendorGuard are hosted and multi-tenant.