Compliance is a requirement.
Regulation isn't a reason to abandon Agile. It's a set of requirements, and requirements belong in the backlog.
Build it into Done
Practice 01
POPIA and security checks are part of the Definition of Done.
IN PRACTICE
No review, not done.
Traceability
Practice 02
Link stories to the requirements and approvals behind them.
IN PRACTICE
Audit trail by default.
Involve early
Practice 03
Legal and compliance join refinement, not just the final sign-off.
IN PRACTICE
Questions before code.
Automate evidence
Practice 04
Pipeline logs, test results and approvals captured automatically.
IN PRACTICE
Evidence without paperwork.
Compliance in every sprint, not at the end.