POPIA and GDPR: what compliant hosting actually means
No web host can make your business compliant with South Africa's Protection of Personal Information Act (POPIA) or Europe's General Data Protection Regulation (GDPR). Both laws keep the business that decides why and how personal information is used accountable for it. What the law asks of a host is narrower: act only on your instructions, keep your data confidential and secure, sign a written agreement with you, and tell you promptly if something goes wrong. This article explains who does what, the questions to ask any host, and where Noiz goes further than the law requires. It is general information, not legal advice.
Who does what: two roles in both laws
POPIA and GDPR divide the work in the same way.
| Role | POPIA term | GDPR term | Who it usually is |
|---|---|---|---|
| Decides why and how personal information is used | Responsible party | Controller | Your business |
| Processes it on that business's behalf | Operator | Processor | Your web host, email provider, cloud service |
For the website, mailboxes and databases you run on a hosting plan, your host is an operator. For its own records about you, such as your account and invoices, the host is itself a responsible party.
The key point is accountability. Section 8 of POPIA puts it on the responsible party, and Article 5 of the GDPR says the controller must be able to demonstrate compliance. Choosing a particular host does not move that duty.
What the law asks of your host
Under POPIA, an operator must:
- Act only with your knowledge or authorisation, and treat the information as confidential (section 20).
- Keep appropriate, reasonable technical and organisational security measures, under a written contract with you that requires them (sections 19 and 21).
- Tell you immediately where there are reasonable grounds to believe someone has accessed your information without authority (section 21).
The GDPR asks more of processors in detail. Article 28 lists what the contract must contain, including acting only on documented instructions, binding staff to confidentiality, controlling sub-processors, helping with people's requests, and deleting or returning data at the end. Article 32 makes security a duty of both controller and processor, and names encryption and pseudonymisation as examples of appropriate measures, alongside the ability to restore data after an incident and regular testing.
What stays with you
Most of the work under both laws is the responsible party's:
- A lawful reason and a clear purpose for collecting each piece of information.
- Collecting only what you need. POPIA's minimality rule (section 10) says information must be adequate, relevant and not excessive for the purpose. The GDPR calls this data minimisation.
- Keeping it no longer than necessary (POPIA section 14).
- Telling people what you collect, usually in a privacy notice.
- Answering people's requests to see or correct their information.
- An Information Officer. Under POPIA the head of your organisation is the Information Officer by default, and must be registered with the Information Regulator before taking up the role.
- Reporting a breach. You notify the Information Regulator and the people affected as soon as reasonably possible (section 22). Since 1 April 2025 the Regulator requires these reports through its eServices portal. Under the GDPR, the deadline to notify the authority is 72 hours where feasible.
- Transfers abroad. POPIA section 72 limits sending personal information to a third party in another country to listed grounds, such as adequate protection in that country, a binding agreement or the person's consent.
When GDPR reaches a South African business
The GDPR can apply to a business outside the EU. Article 3 says it does when the business offers goods or services to people in the EU, or monitors their behaviour there. Such a business must usually appoint a representative in the EU. South Africa does not have an "adequacy decision" from the European Commission, so data sent from the EU to South Africa needs other safeguards. Whether any of this applies to you depends on your business; take advice.
Why "POPIA compliant hosting" is the wrong question
There is no official certificate that makes a host "POPIA compliant" or "GDPR compliant". The GDPR treats approved codes and certifications only as one element in showing compliance. So instead of asking whether a host is compliant, ask it these questions:
- Will you sign a written operator agreement that commits you to security measures and prompt breach notice?
- Who handles my data, and how are the backups kept? Which other companies are involved?
- How is it protected? Encryption in transit, encryption of backups, two-factor sign-in, access controls.
- How will you tell me about a security incident, and how quickly?
- How do I leave? Can I export all my data in standard formats, and what happens to it when I go?
- Who can see my data, and do you use it for anything other than providing the service?
How Noiz goes further
The law sets a floor. Noiz builds on privacy and security together, because each depends on the other:
- Open formats. Private Email works with any standard mail app over IMAP and SMTP, and Nextcloud keeps your files in ordinary formats, so you can export your data and take it elsewhere.
- Encryption. Every hosting plan includes free certificates for your websites, and our managed Backup service keeps backups encrypted at rest. For the conversations that matter most, we recommend end-to-end encryption with OpenPGP; our help article shows how to send encrypted email with Thunderbird.
- Payment privacy. As well as card, we accept Monero, a private cryptocurrency, so your banking details never need to be part of the payment. You still have an account with us, but your bank card does not have to be on file. See how to pay with Monero.
A short checklist
- Register your Information Officer with the Information Regulator.
- Review the forms on your website and remove fields you do not need.
- Publish a privacy notice that matches what you actually collect.
- Sign a written agreement with every operator, including your host.
- Turn on two-factor authentication for your hosting panel; our help article covers two-factor authentication in Plesk.
- Know how you would report a breach through the Regulator's eServices portal.
If you would like to know how your data is protected with Noiz, open a ticket and ask. Noiz is not a law firm; for advice on your own obligations, speak to a qualified adviser.
Sources
Checked 19 October 2026. General information, not legal advice.
South African law and the Regulator
- Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)
- Information Regulator, Guidance notes
- Information Regulator, Guidance note on Information Officers (2021)
- Information Regulator, Reporting security compromises through eServices (7 April 2025)
- Information Regulator eServices portal
European law
Noiz
- Backup service, Private Email, Nextcloud
- Help articles linked in the text, on docs.noiz.ie
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
