What customers want to know about their data
Every business that holds customer information will one day be asked about it: who has it, why, and what happened to it. The way it answers decides whether the customer stays. This piece sets out what a customer wants to know, what South Africa's Protection of Personal Information Act (POPIA) requires, and the rules we keep.
The questions a customer asks
When customers worry about their personal information, they rarely start with the law. They ask plain questions, and they expect plain answers:
- What information does the business hold about them?
- Why did it need it?
- Who else has seen it?
- How long will it be kept?
- How is it protected?
- How can it be corrected, or deleted?
- Who can they complain to if the answer is not good enough?
A business that cannot answer these quickly has a records problem before it has a privacy problem. Usually nobody decided to collect too much or share it carelessly. It happened because the questions were never asked when the form, the system or the process was set up.
What POPIA requires
POPIA turns those questions into eight conditions for processing personal information lawfully. Each one maps onto something a customer asks.
| Condition | POPIA sections | The customer's question it answers |
|---|---|---|
| Accountability | 8 | Who is responsible for their information? |
| Processing limitation | 9 to 12 | Was it needed, and collected fairly? |
| Purpose specification | 13 and 14 | Why is it held, and for how long? |
| Further processing limitation | 15 | Will it be used for something else? |
| Information quality | 16 | Is it correct? |
| Openness | 17 and 18 | Were they told it was being collected? |
| Security safeguards | 19 to 22 | Is it protected, and will they be told if it leaks? |
| Data subject participation | 23 to 25 | Can they see it and have it corrected? |
Two of these do most of the work in practice.
Minimality. Section 10 says personal information may only be processed if, given the purpose, it is adequate, relevant and not excessive. Information you never collected cannot leak, cannot be misused and does not need to be explained.
Security safeguards. Section 19 requires appropriate, reasonable technical and organisational measures to prevent loss, damage and unlawful access. Section 22 requires the responsible party to notify the Information Regulator and the people affected when there are reasonable grounds to believe their information has been accessed by someone without authority.
Section 23 also gives every person the right to ask, free of charge, whether a business holds information about them, and section 24 the right to have wrong, excessive or out-of-date information corrected or deleted. A customer who is not satisfied can complain in writing to the Information Regulator, the independent body that enforces POPIA, through its online eServices portal. The Regulator received 1,355 POPIA complaints in 2024/25, 30% more than the year before.
The rules we keep at Noiz
The law sets the floor. These are the rules we hold ourselves to when the information is yours.
Ask only for what the service needs
A hosting account needs a name, a way to contact you and the details an invoice requires. A domain needs the registrant details the registry asks for. We do not ask for more because a form has room for it.
Say why, at the point of asking
If we ask for something, the reason should be obvious or stated. A request for a document with no reason given is a request a customer should question, and we would rather answer the question before it is asked.
Never sell it
Our values say it plainly: data belongs to the client, with nothing sold and nothing surveilled.
Protect it with what we would want used on our own
Every server we run for clients runs GNU/Linux, and our help centre publishes a PGP key so that clients can send us encrypted email. Sensitive information should not travel in a plain email when an encrypted one is available, and for email we recommend Thunderbird with PGP encryption.
Answer the complaint that was made
When a client raises a concern, the first job is to find the record and answer the question actually asked, not a standard paragraph about how seriously privacy is taken. Then say what will change. A complaint is the cheapest audit a business will ever get.
A short check for your own business
If you hold customer information, try answering these about one customer, today:
- Can you list everything you hold about them, and where it is stored?
- Can you say why you needed each item?
- Do you know which suppliers can see it?
- Would you know within a day if it had leaked?
- Could you correct or delete it on request, everywhere it lives?
Any "no" is the place to start. Most of the fixes are about collecting less and writing down where things are, not about buying anything.
If your own systems hold client information on hosting you are unsure of, our About page sets out how Noiz works, and a ticket reaches the people who run the servers.
Sources
Checked 19 October 2026.
The law
- Protection of Personal Information Act 4 of 2013 (Government Gazette 37067): sections 4, 5, 8 to 25 and 74 to 76
- Information Regulator: complaints
- Information Regulator: POPIA and FAQs
- Information Regulator Annual Report 2024/25, paragraph 2.1.4.1
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
