The Protection of Personal Information Act 4 of 2013 (POPIA) has been enforceable since 1 July 2021. It applies to most South African organisations that process personal information about customers, employees, suppliers or anyone else. This guide focuses on the security conditions; it is general information, not legal advice.
Section 19: security measures
A responsible party must secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of personal information, and unlawful access to or processing of it. In practice that means it must:
- identify all reasonably foreseeable internal and external risks to the personal information it holds;
- establish and maintain appropriate safeguards against those risks;
- regularly verify that the safeguards are effectively implemented; and
- ensure the safeguards are continually updated in response to new risks or deficiencies.
The Act also requires due regard to generally accepted information security practices — which is why recognised controls such as multi-factor authentication, encryption and patching matter.
Sections 20 and 21: operators
An operator is anyone who processes personal information on your behalf — an IT provider, cloud service, payroll bureau or marketing platform. Operators may only process information with your knowledge or authorisation, and you must have a written contract requiring them to establish and maintain security measures and to notify you immediately of suspected compromises.
Section 22: notification of security compromises
Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovery. The notification must give enough information for people to take protective measures. The Regulator prescribes how notifications are submitted, so check its current process — and build it into your incident response plan before you need it.
A practical security checklist
- Know where personal information is. Systems, file shares, mailboxes, spreadsheets, backups and suppliers.
- Control access. Least privilege, regular access reviews and prompt removal of leavers.
- Protect sign-in. Multi-factor authentication for every account, stronger methods for admins.
- Secure devices. Encryption, endpoint protection and timely updates.
- Protect email. Anti-phishing controls and SPF, DKIM and DMARC.
- Limit sharing. Review external and public sharing in Microsoft 365 or Google Workspace.
- Back up and test restores. Backups you have never restored are a hope, not a control.
- Log and monitor. Enable audit logs and route alerts to someone who acts on them.
- Bind operators. Written contracts with security and notification obligations.
- Prepare for incidents. A response plan covering containment, evidence, assessment and notification.
- Train people. Awareness of phishing and correct handling of personal information.
- Review regularly. Re-assess risks when systems, suppliers or threats change.
Other duties to be aware of
Some organisations have additional obligations — for example, the Cybercrimes Act 19 of 2020 places reporting duties on electronic communications service providers and financial institutions, and sector regulators may impose their own requirements. Check which apply to you.