Most organisations built POPIA training once, around the time the Act commenced, and have updated it roughly never since. This is not negligence. It is what happens when updating a course costs more than the update appears to be worth.
The result is a course that describes a privacy practice you no longer follow, delivered annually to people who will act on what it says.
Why privacy training decays faster than other training
Three things change underneath it, and all three are invisible until something goes wrong.
Your processing changes. You adopt a new system, start collecting a new field, change a retention period, or bring in a new operator. None of those events triggers a review of the training, because the training is not in anyone's change-management checklist.
Your policy changes. When the privacy policy is revised, the revision is circulated and filed. The course built from the previous version keeps running, now quietly out of step with the document it was supposed to teach.
Guidance changes. The Regulator issues guidance, an enforcement action clarifies an expectation, and what was defensible practice becomes questionable. Your course still teaches the old position with complete confidence.
Compare that with, say, fire safety training, which is bound to a physical reality that changes slowly. Privacy training is bound to documents and practices that change constantly, which is exactly the property that makes it decay.
The real reason it does not get updated
Ask any L&D team why the POPIA course is two years old and the answer is never that nobody noticed. It is that updating it means finding every affected slide, rewriting the copy, re-recording or re-synthesising narration, rebuilding any activity that referenced the old rule, and pushing the whole thing back through review.
That is a week of work to correct three paragraphs. So it goes on the list, and the list is long, and the course stays as it is.
The problem is not editorial will. It is that the cost of a small correction is almost the same as the cost of a new course.
Making updates cheap enough to actually do
If you want privacy training that stays current, the update has to cost hours rather than a week. A few things make that true:
Build from the document, not from a summary of it. If the course was generated from the policy, regenerating from the revised policy is a bounded operation. If it was written by a person interpreting the policy, every update is a fresh interpretation.
Know which slides are affected. Per-slide citations mean a clause change points you directly at the slides that referenced it. Without that, you re-read the whole course to find three paragraphs.
Keep review proportionate. If a change touches two modules, review two modules. Re-approving an entire course because one clause moved is how organisations teach themselves that updates are expensive.
Version rather than overwrite. The previous version and its approvals should stay available, because someone will eventually ask what the training said in the period they are investigating.
What to do this quarter
You do not need a new platform to start. You need to know how bad it is.
- Date your courses. Find out when each mandatory course was last substantively updated, not when it was last re-published.
- Find the drift. Take your current privacy policy and read it against the course. Note every place they disagree. This is uncomfortable and usually quick.
- Cost the correction. Work out honestly what it would take to fix. That number is the argument for changing how you build.
- Add training to change management. Whoever approves a policy revision should trigger a training review at the same time. Without this, everything above happens once and then stops.
The uncomfortable conclusion
A privacy course that is two years out of date is not neutral. It actively teaches people to do the wrong thing, with your organisation's authority behind it, and you have a completion record proving you told them.
That is a worse position than having no training at all, and it is the position most organisations are in.
This is general commentary on a common operational problem, not legal advice. Check your obligations with someone qualified to advise on them.
Scheduled for review by 22 December 2026. We review anything that touches regulation on a cycle, because a confidently wrong post about compliance is worse than no post.