The Protection of Personal Information Act (POPIA) asks every South African business to keep personal information secure. It doesn't list specific products — it asks for “appropriate, reasonable technical and organisational measures”. Here is what that looks like in your IT, in practice.

This article is practical IT guidance, not legal advice. Speak to your information officer or legal adviser about your specific obligations.

What POPIA expects

Section 19 — secure the integrity and confidentiality of personal information, identify foreseeable risks, put safeguards in place and keep them up to date.
Section 21 — make sure suppliers who process information for you (operators) protect it too, under a written contract.
Section 22 — notify the Information Regulator and affected people as soon as reasonably possible after a security compromise.

A practical IT checklist

Access control

MFA on every account, starting with email and admin accounts.
Access based on role — people only see the data they need.
Prompt removal of access when staff leave.

Protect devices and data

Disk encryption (BitLocker) on every laptop.
Endpoint protection and regular patching on all devices.
The ability to wipe a lost or stolen phone or laptop remotely.

Email and sharing

SPF, DKIM and DMARC to stop criminals impersonating your domain — see our plain-English guide.
Block automatic forwarding of email to outside addresses.
Limit “anyone with the link” sharing in OneDrive and SharePoint.

Backups and availability

Backups of Microsoft 365 and servers, including an immutable copy.
Regular restore tests — read why backups aren't enough without them.

Monitoring and evidence

Audit logging switched on and kept for a sensible period.
Alerts for risky sign-ins and suspicious mailbox rules.
A record of the controls you have in place and when they were reviewed.

People and suppliers

Short, regular security awareness training, including phishing.
Written agreements with IT and cloud suppliers covering data protection.

Have a breach plan before you need it

When something goes wrong, the first hours matter. Decide in advance who leads the response, who contacts your IT provider, insurer and legal adviser, and who handles notification. The Information Regulator expects security compromises to be reported through its online portal, so know where to find it and what information you will need.

How MVT helps

Our cybersecurity services put these controls in place and keep them running, with backup and disaster recovery and Microsoft Sentinel monitoring for evidence when you need it. You can read how we handle personal information ourselves in our privacy policy.

Book a POPIA security review →