If you run a small business in South Africa, you have almost certainly heard of POPIA, the Protection of Personal Information Act. You may have updated your website's privacy notice or added a consent tick-box to a form. But the part of POPIA that catches most small businesses out isn't paperwork. It's security.
This guide explains, in plain language, what POPIA expects you to do to protect the personal information on your computers, phones and cloud accounts. It also gives you a checklist you can work through without a security team.
This article is practical guidance, not legal advice. If you're unsure how POPIA applies to your situation, speak to an attorney or a data protection specialist.
The short version
POPIA doesn't give you a list of products to buy. Instead, it says you must take "appropriate, reasonable technical and organisational measures" to keep personal information safe from loss, damage and unauthorised access. "Reasonable" depends on your size, the type of information you hold and the risks you face. A five-person bookkeeping firm isn't held to the same standard as a bank, but it is expected to do the basics properly and be able to show that it did.
If a breach happens, the question the Information Regulator will ask is simple: did you take reasonable steps, or didn't you?
Who does this apply to?
Almost every business. If you collect or store information about identifiable people, such as customers, patients, learners, employees or suppliers who are sole proprietors, you are a "responsible party" under POPIA. That includes:
- names, ID numbers, phone numbers and email addresses
- bank details and payslips
- CVs and employment records
- medical, financial or legal records
- CCTV footage and photos of identifiable people
POPIA also protects information about companies and other juristic persons, not just individuals.
What section 19 actually asks for
Section 19 is the heart of POPIA's security requirements. In everyday terms, it asks you to do four things, continuously:
- Identify the risks. Work out what could reasonably go wrong, from both outside (hackers, phishing, ransomware) and inside (a staff member taking files, a lost laptop, someone emailing a spreadsheet to the wrong person).
- Put safeguards in place. Take steps that address those risks, such as passwords, backups, updates and access controls.
- Check that the safeguards work. Don't assume. Regularly verify that backups restore, updates are installed and alerts are being looked at.
- Keep them up to date. When new risks appear, or your business changes, adjust.
The Act also says you must have "due regard to generally accepted information security practices". In other words, you're expected to follow the ordinary good practice that IT professionals would recognise. You don't need exotic technology.
The other sections you should know about
Section 20 and 21: your service providers (operators). If someone processes personal information on your behalf, such as your IT support company, payroll bureau, cloud accounting system or email provider, POPIA calls them an operator. You need a written contract requiring them to keep the information secure and to tell you immediately if they suspect a breach. Check your existing agreements; many small businesses have never looked.
Section 22: telling people when something goes wrong. If you have reasonable grounds to believe personal information has been accessed or acquired by someone unauthorised, you must notify the Information Regulator and the affected people "as soon as reasonably possible". The notice must explain what happened, what the possible consequences are, what you're doing about it and what people can do to protect themselves. You can't delay just to avoid embarrassment. Our step-by-step guide to reporting a POPIA breach covers the process in detail. Check the Information Regulator's website (inforegulator.org.za) for the current way to submit a notification.
This is where many businesses get stuck. You can't report what you can't see. If nobody is watching your systems, you may only discover a breach months later, when a client calls to say their details are for sale.
Special personal information and children. Health information, biometric data, religious beliefs, criminal records and information about children get extra protection. If you're a medical practice, a school or a law firm, the bar for "reasonable" security is higher.
The Information Officer
Every business has an Information Officer. By default it's the head of the business: the owner, CEO or managing partner. They are responsible for making sure POPIA is complied with, including the security side, and must be registered with the Information Regulator. You can delegate the work to a Deputy Information Officer, but not the responsibility.
What can happen if you get it wrong
- Administrative fines of up to R10 million, and in some cases criminal penalties.
- Civil claims from people whose information was compromised.
- Enforcement notices requiring you to fix specific problems by a deadline.
- The cost nobody puts on paper: lost clients, time spent cleaning up and reputational damage that lingers.
For most small businesses, the real risk isn't a headline fine. It's a breach you can't explain, followed by clients who quietly leave.
A practical POPIA security checklist
Here is what "reasonable" looks like for a typical South African SME. You don't need everything on day one, but you should be able to show progress.
Know what you hold
- List where personal information lives: laptops, the file server, email, cloud accounts (Google Workspace, Microsoft 365, Dropbox), accounting software, WhatsApp groups and paper.
- Delete what you no longer need. POPIA requires you not to keep personal information longer than necessary, and data you don't have can't be stolen.
Lock the front doors
- Turn on multi-factor authentication (MFA) for email, cloud storage, banking and accounting systems. This single step stops a large share of account takeovers.
- Use a password manager and unique passwords. Remove accounts for people who have left.
- Give staff access only to what they need for their job.
Keep devices healthy
- Install operating system and software updates promptly. Most successful attacks use weaknesses that already have a fix.
- Run antivirus or endpoint protection on every laptop, desktop and server.
- Encrypt laptops (BitLocker on Windows, FileVault on Mac) so a stolen device doesn't become a data breach.
Plan for the bad day
- Keep backups that follow the 3-2-1 idea: three copies, on two types of storage, with one copy offline or off-site. Test a restore at least once a quarter.
- Write a one-page incident response plan: who to call, how to isolate a device, how to decide whether a section 22 notification is needed.
Watch and verify
- Have someone, or something, monitoring your devices for suspicious activity, such as failed log-ins at 2am, new admin accounts, malware alerts and unusual file changes.
- Keep records: when updates were installed, which alerts were investigated and what was done. If the Regulator ever asks, evidence of ongoing monitoring is far more convincing than a policy document in a drawer.
Train your people
- Run short, regular phishing awareness sessions. Most incidents start with an email.
- Make it easy and blame-free for staff to report "I think I clicked something".
Where monitoring fits in
Notice how much of section 19 is about verifying and updating, and how section 22 depends on noticing a breach in the first place. That's the gap most small businesses have: they have antivirus and a backup, but nobody is watching.
That's the gap EZ Cyber Guard was built to fill. It continuously monitors your laptops, desktops and servers, explains alerts in plain language, tracks missing patches and vulnerabilities, and maps what it sees to POPIA controls, so you have evidence of the "reasonable measures" you're taking. See how monitoring maps to POPIA's security duties. It doesn't make you compliant on its own; no product can. But it gives you the visibility that POPIA quietly assumes you have.
Not sure where your business stands? The free POPIA Security Readiness Check takes about three minutes and gives you a prioritised list of gaps.
Your next three steps
- This week: switch on MFA for email and banking, and check who still has access to your systems.
- This month: test a backup restore and write your one-page incident plan.
- Ongoing: put monitoring in place so that if something does go wrong, you find out in minutes, not months.