3 September 2026LANTEK Computers
The most common thing we hear from a business owner about POPIA is a version of the same sentence: we know we are supposed to be doing something, we are not sure what, and we do not have anybody here who could tell us. That is a fair position to be in. The Act is written for organisations of every size, from a bank to a three person practice, so it deliberately does not hand you a checklist.
What it does instead is set a standard and leave the implementation to you. That sounds worse than it is. It means a business of eleven people is not expected to have what a business of eleven hundred has. It also means you cannot buy a product that makes you compliant, because compliance is a set of decisions and records, not a piece of software.
The standard is reasonableness, and it is measured against your business
Section 19 is the part that governs security, and its language is about reasonable measures. Reasonable is doing a lot of work in that sentence. It means appropriate to the sensitivity of the information, to the harm that would follow if it leaked, and to what is generally accepted practice in your line of work.
So the first question is not what should we install. It is what would actually hurt if it got out. A conveyancing practice holding banking details and transfer instructions is in a different position to a landscaping business holding client addresses. Both have obligations. They are not the same obligations, and pretending otherwise is how small businesses end up paying for controls they do not need while missing the one they do.
Start with what you hold, not with what you should buy
Almost every POPIA project that goes badly starts at the technology and works backwards. The ones that go well start with an inventory, because you cannot protect information you have not located.
This is genuinely something you can do yourself in an afternoon, and it does not need to be elegant. Write down every place personal information about a living person or an existing company sits. Not categories. Places.
- The accounting package, and whether its data file lives on a server or on somebody’s desktop
- Mailboxes, which for most businesses hold more personal information than any system does
- Shared drives, including the folder somebody made in 2019 that nobody has opened since
- The HR file, whether it is digital or a locked cabinet
- WhatsApp, if quotes and client details move through it, which in South Africa they usually do
- Any spreadsheet a staff member keeps because the real system is awkward
- Cloud services signed up to with a work email address, which nobody centrally approved
- The CCTV recorder and the access control system
- The visitor book at reception
That last group is the one that surprises people. Cameras, biometric readers and a clipboard at the front desk are all collecting personal information, and they all sit inside POPIA’s scope.
When the list is done, mark each entry with two things: roughly how sensitive it is, and who can currently reach it. The second column is where most of the real findings are. It is very common to discover that everybody can reach everything, because the shared drive was set up in a hurry and never revisited.
The measures that carry the most weight for the least effort
With the inventory in front of you, a small number of controls do a disproportionate amount of work. None of them require a technical person on staff.
Multi-factor authentication on email, first and without exception
If you do one thing, do this. A stolen password is only useful while it is the only thing standing in the way. Turning on multi-factor authentication means a password on its own stops being enough, and the great majority of the incidents we are called about begin with a working password in somebody else’s hands.
It is worth being honest that staff will find it irritating for about a fortnight, and that the objections are usually about the process rather than the principle. Handle it as a rollout with a date and an explanation, not as a switch flipped on a Friday.
Access that matches the job
Nobody needs access to everything. Go through the second column of your inventory and take away what is not needed for somebody to do their work. This costs nothing and it limits how far any single compromised account can reach.
The same applies when somebody leaves. A leaver’s account that still works is one of the easiest findings to produce and one of the hardest to explain.
Backups that somebody has restored from
POPIA is concerned with availability as well as confidentiality: losing personal information counts, not only leaking it. A backup nobody has ever restored from is a plan, not a control. Pick a quarter, restore something real, and write down that you did it.
Devices that lock and encrypt
Laptops leave buildings. A laptop with disk encryption turned on and a password on the lock screen is a laptop that got stolen. Without those, it is a data breach with a value attached.
A written record of the decisions
This is the one that gets skipped, and it is the one that matters most if you are ever asked. Reasonable measures that exist only in your head cannot be demonstrated. A few pages naming what you hold, what you have done about it, who decided, and when, is worth more than a far more expensive set of controls nobody documented.
The obligations that are not about technology at all
A good share of POPIA has nothing to do with systems, and these are the parts a business with no IT department can complete without help.
You already have an Information Officer. If nobody was appointed, it defaults to the head of the business. The role is real and it is registerable. Our Information Officer page sets out what the job involves.
You need to know why you hold things. Personal information collected for one purpose should not quietly be used for another. If you took an address to deliver an order, that is what it is for.
You should not be keeping everything forever. Information you no longer have a reason to hold is pure liability. Deciding how long you keep things, and then actually deleting them, reduces the size of any future incident.
Your suppliers are your problem too. If a third party processes personal information on your behalf, whether that is a payroll bureau or a marketing agency, there should be an agreement in place saying they will secure it. Their breach is still your notification.
What good looks like when you get there
You are not aiming for a certificate. There is no POPIA certification to hold up, and any supplier who offers you one is selling you something that does not exist.
What you are aiming for is the ability to answer three questions without preparation. What personal information do you hold. What have you done to protect it. Who decided that was enough, and when. A business that can answer those three is in a materially better position than one with more technology and no answers.
Where an outside provider is actually worth it
Plenty of the above you can do yourself, and you should, because you know your business better than any provider will. What tends to be worth buying in is the part that has to keep happening: the monitoring, the patching, the review of who has access to what, and somebody to call at the point when something has clearly gone wrong and the decisions get harder.
The way we think about it is set out on Compliant by design, and what a managed service should actually cover is on Managed IT Services. If you would rather just ask somebody, that is what the free health check is for. Thirty minutes, no obligation, and you keep the report either way.