POPIA for IT systems: a technical implementation guide

The Protection of Personal Information Act (POPIA) requires South African organisations to protect personal data. While compliance starts with policies and processes, it ultimately depends on how your IT systems are designed and operated. This guide focuses on the technical side: what IT needs to do to support POPIA.

Data mapping and discovery

Before you can protect data, you need to know where it lives. A data mapping exercise identifies:

Systems that store personal information – CRM, HR, finance, email, file shares, databases.
Data flows – where data enters, how it moves between systems, and where it leaves (e.g. to cloud providers, partners, or backups).
Data owners – who is responsible for each dataset.
Retention requirements – how long you must keep data and when it should be deleted.

IT should work with legal and business owners to document this. Tools like data discovery software can help, but a structured spreadsheet or data inventory is often enough to start.

Data mapping checklist

Area	Questions to answer
Systems	Which applications store PII? Where are they hosted?
Data types	What categories of PII (names, IDs, financial, health)?
Flows	How does data move? Who has access?
Third parties	Which vendors process your data? What do their contracts say?
Retention	How long do you keep data? Is deletion automated?

Access control and least privilege

POPIA requires that personal information is only accessible to those who need it for a legitimate purpose. Technically, that means:

Role-based access control (RBAC) – users get access based on their role, not ad-hoc permissions. Review and remove unnecessary access regularly.
Principle of least privilege – users and service accounts should have the minimum access required to do their job.
Access reviews – quarterly or semi-annual reviews of who has access to what. Remove access when roles change or people leave.
Privileged access management (PAM) – administrative access to systems holding personal data should be controlled, logged, and time-limited where possible.

Identity and access management is central to POPIA. Weak IAM is one of the most common causes of data exposure.

Access control implementation steps

Inventory access – document who has access to each system holding PII.
Define roles – map roles to business functions; assign permissions by role.
Remove orphaned access – when people leave or change roles, revoke access immediately.
Enforce MFA – multi-factor authentication for all access to systems with personal data.
Schedule reviews – quarterly access reviews with sign-off from data owners.

Encryption

POPIA does not explicitly mandate encryption, but the Information Regulator expects reasonable technical measures. Encryption should cover:

Data at rest – databases, file shares, backups. Use full-disk encryption on laptops and encrypt sensitive databases and storage.
Data in transit – TLS for web traffic, email, and API calls. Avoid sending personal data over unencrypted channels.
Key management – encryption keys should be stored securely and rotated according to policy.

For many organisations, Microsoft 365 and Google Workspace provide encryption by default. The gap is often in legacy systems, file shares, and backups.

Encryption priorities

Priority	What to encrypt	How
High	Databases with PII	TDE, column-level, or application-level
High	Laptops and mobile devices	Full-disk encryption (BitLocker, FileVault)
High	Backups	Backup software encryption, encrypted storage
Medium	File shares	Encrypted volumes or per-file encryption
Medium	Email	TLS in transit; consider encryption at rest for sensitive content

Backup and recovery

Backups contain personal information. They must be:

Encrypted – backup data should be encrypted at rest and in transit.
Access-controlled – only authorised personnel should be able to restore from backup.
Retention-aligned – backup retention should align with your data retention policy. Do not keep backups longer than necessary.
Tested – recovery procedures should be tested so you know backups work and you can restore within your RTO.

See our backup strategy guide and business continuity services for more detail.

Logging and monitoring

To detect and respond to unauthorised access or data breaches, you need visibility:

Access logs – who accessed what, when. Critical for systems holding personal data.
Security monitoring – SIEM, EDR, and alerting to detect anomalies and potential breaches.
Audit trails – changes to access rights, configuration changes, and data exports should be logged.

POPIA requires you to notify the Information Regulator and data subjects of a breach. Without logs, you cannot determine scope or timeline, which makes notification and remediation much harder.

What to log

User authentication (success and failure)
Access to sensitive data (exports, bulk access)
Privileged actions (admin changes, access grants)
Configuration changes to systems holding PII
Data transfer and sharing events

Log retention

Retain logs for at least 12 months, or longer if required by your industry or retention policy. Ensure logs are tamper-protected and access is restricted.

Breach response

When a breach occurs, IT has a central role:

Contain – isolate affected systems, revoke compromised credentials, prevent further exfiltration.
Assess – what data was accessed? How many individuals? Use logs and forensics.
Notify – the Information Regulator and data subjects must be notified as soon as reasonably possible. IT provides the technical facts.
Remediate – patch vulnerabilities, strengthen controls, update procedures.
Document – maintain a breach register and evidence for the Regulator.

Having an incident response plan and tested procedures reduces delay and improves outcomes.

Breach notification timeline

POPIA requires notification “as soon as reasonably possible” after discovery. In practice:

Internal assessment – 24–48 hours to determine scope and impact.
Regulator notification – as soon as you have enough information to report.
Data subject notification – when you can identify affected individuals and have guidance on what to tell them.

Do not delay notification while you complete a full forensic investigation. Provide what you know; supplement as you learn more.

Third-party and cloud

If you use cloud providers or outsourced systems that process personal data, you need:

Data processing agreements – contracts that require the processor to protect data in line with POPIA.
Due diligence – understand where your provider stores data, what security controls they have, and whether they can support your compliance obligations.
Sub-processor visibility – many SaaS providers use sub-processors. Ensure your agreements cover the full chain.

South African businesses often use Microsoft 365, Google Workspace, AWS, or Azure. These vendors offer compliance documentation and data processing terms. The responsibility for configuring access, encryption, and retention correctly remains with you.

Cloud provider checklist

Data processing agreement in place
Data residency (South Africa preferred for POPIA)
Encryption at rest and in transit
Access controls and MFA configured
Logging and audit trail enabled
Retention and deletion configured

Getting help

POPIA compliance is a cross-functional effort: legal, HR, and IT all have roles. If your IT team lacks the capacity or expertise to implement these controls, consider IT governance and compliance support or a cybersecurity assessment to identify gaps.