Security measures (s19)
Appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction and unlawful access to personal information.
Protection of Personal Information Act · South Africa
POPIA security safeguards you can evidence.
POPIA requires responsible parties to secure personal information with appropriate, reasonable technical and organisational measures, and to report every security compromise. From our Cape Town office, we help South African organisations prove their safeguards work.
At a glance
Security is a condition of lawful processing.
The Protection of Personal Information Act 4 of 2013 sets eight conditions for lawful processing. Condition 7, security safeguards (sections 19 to 22), is where cybersecurity and data protection meet.
Since 1 April 2025, the Information Regulator requires all section 22 security compromise notifications to be submitted through its eServices portal. POPIA has no materiality threshold, so all security compromises must be reported, whatever their assessed risk level.
| Instrument | Protection of Personal Information Act 4 of 2013 |
|---|---|
| Regulator | Information Regulator (South Africa) |
| Security safeguards | Sections 19–22 (Condition 7) |
| Breach notification | To the Regulator and data subjects as soon as reasonably possible, via the eServices portal since 1 April 2025 |
| Information Officers | Must be registered with the Regulator |
| Sanctions | Administrative fines up to R10 million; certain offences carry fines or imprisonment |
Scope
Who POPIA applies to.
POPIA applies to any public or private body that processes personal information entered in a record in South Africa. It covers both responsible parties, which decide why and how information is processed, and operators, which process it on their behalf.
- Financial services, insurers and fintechs, which must also meet Joint Standard 2 on cybersecurity and cyber resilience
- Healthcare, retail, telecoms and education organisations holding large volumes of personal information
- Operators such as cloud, payroll, call-centre and IT service providers, which need written mandates and must notify responsible parties of compromises
- International organisations processing personal information in South Africa
Requirements
Security obligations under POPIA.
Sections 19 to 22 define what responsible parties and operators must do to secure personal information and respond to compromises.
Operators (s20–21)
Operators may only process information with the responsible party's knowledge or authorisation, under a written contract requiring security measures.
Operator notification (s21)
Operators must notify the responsible party immediately if there are reasonable grounds to believe personal information has been compromised.
Security compromise notification (s22)
Notify the Information Regulator and affected data subjects as soon as reasonably possible after discovery, with enough detail for data subjects to protect themselves.
Information Officer
Register the Information Officer and any Deputy Information Officers, and support their compliance responsibilities.
Cross-border transfers (s72)
Ensure adequate protection when transferring personal information outside South Africa, including to cloud providers.
Common gaps
Common POPIA security gaps.
- Risk assessments that do not identify where personal information is actually stored, including cloud and SaaS platforms
- No regular verification, through testing or audit, that safeguards work as intended
- Operator agreements missing security, notification and audit clauses
- Breach response plans that predate the eServices portal or assume low-risk compromises need not be reported
- Unclear ownership between the Information Officer, IT and security teams
- Cross-border transfers to cloud providers without documented adequacy analysis
Free checklist
POPIA Security Safeguards Checklist
A practical checklist covering section 19 safeguards, operator agreements, section 22 notification through the eServices portal and evidence of regular verification.
FAQs
POPIA questions we hear most often
Do we have to report every security compromise under POPIA?
Yes. The Information Regulator states that POPIA has no threshold for reporting, so all security compromises must be reported regardless of the assessed level of risk.
How do we notify the Information Regulator of a compromise?
Since 1 April 2025, section 22 notifications must be submitted through the Information Regulator's eServices portal. Data subjects must also be notified in writing, for example by email, post or a prominent notice on your website.
What counts as appropriate, reasonable security measures?
POPIA does not prescribe specific controls. Responsible parties must identify foreseeable risks, put proportionate safeguards in place, verify them regularly and have due regard to generally accepted information security practices, such as ISO 27001.
Are operators liable under POPIA?
The responsible party remains accountable. Operators must process information only with authorisation, maintain security measures required by a written contract, and notify the responsible party immediately of any suspected compromise.
How does POPIA relate to Joint Standard 2?
Financial institutions regulated by the FSCA and Prudential Authority must also comply with Joint Standard 2 of 2024 on cybersecurity and cyber resilience, which took effect on 1 June 2025. The two overlap significantly, and we assess them together.
Related services and guidance
Sources
- Information Regulator: POPIA and security compromise FAQs
- POPIA section 22: Notification of security compromises
- Protection of Personal Information Act, South African Government
This page is general guidance, not legal advice. Last reviewed 27 October 2026.