POPIA & Cybersecurity
POPIA and cybersecurity: protecting personal information
Practical technical and organisational security measures aligned to the Protection of Personal Information Act — so you can protect personal information, and show that you do.
What does POPIA require for cybersecurity?
Section 19 of POPIA requires a responsible party to secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures: identifying reasonably foreseeable risks, establishing and maintaining safeguards, regularly verifying they work and updating them. Section 22 requires notifying the Information Regulator and affected data subjects of security compromises as soon as reasonably possible.
Security is the part of POPIA that technology owns
The Protection of Personal Information Act 4 of 2013 has been enforceable since 1 July 2021. Much of POPIA is about lawful purpose, consent and transparency — but condition 7, security safeguards (sections 19 to 22), is where technology and cybersecurity carry the obligation.
POPIA does not prescribe specific products. It requires measures that are appropriate and reasonable for the information you hold and the risks it faces, with regard to generally accepted security practices. That makes a risk-based security assessment the natural starting point. Read our guide to POPIA and cybersecurity.
This page describes our services; it is not legal advice. For legal interpretation of your obligations, consult a South African attorney.
How we help
Risk identification
Find where personal information lives and the reasonably foreseeable risks to it (s19).
Safeguards
Identity, access, encryption, device, email and backup controls proportionate to the risk.
Verification
Regular review that safeguards are working — and evidence that they are.
Operator arrangements
Technical input to written contracts requiring operators to maintain security measures (s20–s21).
Breach readiness
An incident response plan including how compromises are assessed and notified (s22).
Staff awareness
People who know how to handle personal information and report incidents.
A practical POPIA security programme
01
Map personal information
Systems, files and suppliers that hold or process it.
02
Assess risks
Likelihood and impact of loss, unauthorised access or disclosure.
03
Implement safeguards
Prioritised technical and organisational measures.
04
Prepare for incidents
Detection, response, evidence and notification procedures.
05
Verify and update
Periodic review as systems, suppliers and threats change.
Connected capabilities
Where this connects to the rest of the work
Technology does not operate in silos. These are the capabilities that most often sit alongside this one in a real engagement.
FAQ
Frequently asked questions
Does POPIA apply to my business?
POPIA applies to the processing of personal information by responsible parties in South Africa, with limited exclusions — which covers most organisations that hold information about customers, employees or suppliers.
What happens if personal information is compromised?
Section 22 requires the responsible party to notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovering the compromise, with enough information for people to protect themselves. The Regulator prescribes how notifications are submitted.
What are the penalties under POPIA?
POPIA provides for administrative fines of up to R10 million and, for certain offences, criminal penalties — alongside potential civil claims and reputational damage.
Do our IT suppliers have POPIA obligations?
Suppliers that process personal information on your behalf are operators. POPIA requires a written contract ensuring they maintain appropriate security measures and notify you of compromises.
Is encryption mandatory under POPIA?
POPIA does not name specific technologies, but encryption of devices and data in transit is generally accepted security practice and frequently an appropriate, reasonable measure.
Ready when you are
Protect personal information — and show that you do
We will map where personal information lives, the risks to it and the safeguards that matter most.