The Protection of Personal Information Act has been enforceable since July 2021, and most small businesses have done some of it — a privacy policy on the website, usually — and none of the rest.
The rest is mostly technical and mostly unglamorous. Work down this list and you will know where you stand. A note before you start: we handle the technical side of compliance. We are not attorneys, so anything requiring a legal opinion should go to one.
1. Know what personal information you actually hold
You cannot protect what you have not listed. Most businesses are surprised by how much personal information sits outside their main system — in spreadsheets, in email attachments, in a WhatsApp group, in an old backup nobody has looked at in years.
- Customer records: names, contact details, ID numbers, addresses
- Employee records: contracts, payroll, medical and disciplinary files
- Supplier and contractor contacts
- CCTV footage, visitor books and access logs
- Anything in a spreadsheet on someone’s desktop
2. Know who can reach it
POPIA expects access to be limited to people who need it. The common failure is that everyone can see everything, because permissions were never set up and nobody wanted to be the one asking awkward questions.
Check who has access to payroll, to the customer database, to shared drives, and to the email account that receives enquiries. Then check whether any of those people have left.
3. Have a lawful reason for holding each thing
Every piece of personal information needs a justification: consent, a contract, a legal obligation, or a legitimate interest. In practice this means being able to answer “why do we have this?” for anything you store — and if the answer is “we are not sure”, that is a finding.
4. Delete what you no longer need
Retention is the requirement most often ignored, and the easiest to act on. Holding data forever increases both your risk and the size of any breach. Decide how long each category of information needs to be kept, write it down, and actually delete the rest.
5. Secure it technically
This is where most of the practical work sits, and where a technical partner makes the biggest difference.
- Multi-factor authentication on every account that holds personal information
- Encryption on laptops and phones, so a stolen device is not a breach
- Backups that are tested by actually restoring from them
- Access removed on the day someone leaves, not weeks later
- Staff who can recognise a phishing email, because that is the usual entry point
6. Know what you would do in a breach
POPIA requires you to notify the Information Regulator and affected people when personal information is compromised. Deciding how you would do that while it is happening is the worst possible time.
Write down who is called, who decides, and who communicates. One page is enough.
7. Appoint and register an Information Officer
Every organisation has one by default — the head of the business — and they must be registered with the Information Regulator. This is an administrative step that takes very little time and is frequently missed entirely.