POPIA cybersecurity requirements: what your business must do
The POPIA cybersecurity requirements are short on paper but wide in practice. If you hold personal information about customers, staff or suppliers, the law expects you to protect it, to know when it has been compromised, and to report breaches promptly. Here is what that means in plain English.
Which parts of POPIA deal with cybersecurity?
The Protection of Personal Information Act (Act 4 of 2013), known as POPIA, has been fully enforceable since 1 July 2021. Its security rules sit in Condition 7, "Security safeguards", which covers sections 19 to 22 of the Act. Every South African organisation that processes personal information, from a five-person practice to a metro municipality, must comply.
Section 19: reasonable technical and organisational measures
Section 19 is the core of the POPIA cybersecurity requirements. You must secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures to prevent its loss, damage, unauthorised destruction, and unlawful access or processing. In practice, the Act says you must:
- Identify all reasonably foreseeable internal and external risks to the personal information you hold.
- Establish and maintain appropriate safeguards against those risks.
- Regularly verify that the safeguards are working.
- Keep the safeguards updated as new risks appear or weaknesses are found.
You must also have due regard to generally accepted information security practices, including any rules specific to your industry. POPIA does not list specific products. It expects you to be able to show that your controls are reasonable for the risks you face.
Sections 20 and 21: your IT providers and other operators
An "operator" is anyone who processes personal information on your behalf, such as a cloud provider, payroll bureau or outsourced IT company. POPIA requires a written contract making sure the operator maintains the same security measures you must. The operator must also tell you immediately if it believes personal information has been accessed by an unauthorised person. If your supplier contracts are silent on security, that is a gap.
Section 22: reporting a security compromise
If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, you must notify the Information Regulator and the affected people as soon as reasonably possible after discovering it. The notice must give people enough detail to protect themselves. Breach notifications to the Regulator must now be submitted through its online eServices portal.
The practical problem: you cannot report a breach you never noticed. Without logging and monitoring, many organisations only find out about an attack weeks later, from a customer, a bank or a ransom note. That is why continuous monitoring is one of the most useful ways to meet section 22.
What happens if you don't comply?
The Information Regulator can investigate, issue enforcement notices and impose administrative fines of up to R10 million. Some offences under the Act carry prison sentences, and affected people can bring civil claims for damages. The reputational damage of a public breach is often the larger cost.
A practical POPIA cybersecurity checklist
- Appoint and register your Information Officer with the Information Regulator
- Map where personal information is stored: servers, cloud apps, email, laptops and paper files
- Run a security risk assessment and record the results
- Enforce multi-factor authentication on email, Microsoft 365 and remote access
- Keep systems patched and protect every endpoint
- Encrypt laptops, backups and sensitive data in transit
- Keep tested, offline or immutable backups
- Collect security logs centrally (a SIEM) and have someone monitor them
- Write an incident response plan that includes the section 22 notification steps
- Add security clauses to operator and supplier contracts
- Train staff to recognise phishing and report incidents
- Review your controls at least once a year
How Acorn helps you meet the POPIA security requirements
Security assessment
We identify your risks and gaps against section 19, and give you a prioritised plan.
Managed SOC and SIEM
Continuous monitoring so breaches are detected quickly, not weeks later.
Incident response
Help to contain an incident and gather the facts you need for a section 22 notification.
Evidence and reporting
Monthly reports that show your board, auditors and the Regulator the measures you have in place.
Frequently asked questions
What are the POPIA cybersecurity requirements?
Section 19 of POPIA requires organisations to take appropriate, reasonable technical and organisational measures to protect personal information, to identify risks, maintain safeguards, verify that they work and keep them updated. Sections 20 to 22 cover operators and the duty to report security compromises.
Does POPIA require specific security software?
No. POPIA does not name products or standards. It requires measures that are reasonable for your risks and in line with generally accepted information security practices. You need to be able to show what you did and why.
How quickly must a data breach be reported under POPIA?
As soon as reasonably possible after the breach is discovered. You must notify both the Information Regulator, through its online portal, and the affected data subjects, unless their identity cannot be established.
Do small businesses have to comply with POPIA?
Yes. POPIA applies to any public or private body in South Africa that processes personal information, regardless of size. What counts as reasonable security does scale with the size of the organisation and the sensitivity of the data.
This page is general guidance, not legal advice. For the full text of the Act and the Regulator's guidance, visit the Information Regulator's website. Speak to your legal adviser about your specific obligations.
Find out where your POPIA security gaps are
Book a free security assessment and we'll show you how your current controls measure up against the POPIA security requirements. Call 021 001 0009 or email sales@acorntelecoms.co.za.
Book a free POPIA security assessment
Somerset West, Western Cape, South Africa — serving clients nationally.