Security is what keeps privacy possible
Privacy is a promise about who may see your information. Security is what keeps that promise when someone tries to break it. A business can have the best privacy policy in the country and still expose every customer's details if a mailbox password is stolen or a laptop goes missing unencrypted. South Africa's Protection of Personal Information Act (POPIA) makes the same point in law: among its eight conditions for processing personal information lawfully, one is security safeguards. This article explains what that condition asks of a business, what happens when information is compromised, and the practical steps that make privacy hold.
Privacy and security are one job
People sometimes treat privacy as a legal matter and security as a technical one. In practice they cannot be separated:
- Privacy without security is a statement of intent. Promising not to share customer data means little if an attacker can take it.
- Security without privacy misses the point. Protecting systems matters because of the people whose information is inside them.
POPIA builds the link in. Its seventh condition, security safeguards, sits beside accountability, purpose, openness and the rest, and a failure of security is a failure to process information lawfully.
What POPIA asks: section 19
Section 19 requires a business to secure the integrity and confidentiality of the personal information in its possession or under its control, with appropriate, reasonable technical and organisational measures against loss, damage, unauthorised destruction and unlawful access. It then sets out a method that suits a business of any size:
- Identify the risks. List the reasonably foreseeable internal and external risks to the information you hold.
- Put safeguards in place against those risks, and maintain them.
- Check that they work. Verify regularly that the safeguards are actually in effect.
- Keep them current. Update them as new risks appear or weaknesses are found.
The Act asks for due regard to generally accepted information security practice. In plain terms: do what a sensible, informed business in your position would do.
Your providers are part of this. Section 21 requires a written contract with any operator that processes information for you, such as your hosting, email or IT provider, binding it to the same safeguards and to tell you immediately if it suspects unauthorised access.
When something goes wrong: section 22
When there are reasonable grounds to believe personal information has been accessed or acquired by someone without authority, section 22 requires the business to notify both the Information Regulator and the people affected, as soon as reasonably possible. The notice to the people affected must be in writing and must tell them enough to protect themselves: the possible consequences, what the business has done, what they should do, and who was responsible, if known.
The Regulator's own guidance adds three points worth knowing:
- There is no threshold. POPIA sets no minimum size for a reportable compromise.
- A compromise is broad. It covers information lost, shared with the wrong person or destroyed, not only taken by an outsider. The Regulator has described the range as running from an email sent to the wrong person to ransomware.
- Report through the portal. Since 1 April 2025, the Regulator's guidance is that compromise notifications should be made through its eServices portal.
The scale is growing. In the year to 31 March 2025, the Regulator received 2,374 security compromise notifications, 37% more than the year before.
The criminal side: the Cybercrimes Act
The Information Regulator deals with whether a business's security was adequate. The crimes themselves fall under the Cybercrimes Act 19 of 2020, which came largely into force on 1 December 2021. It makes offences of, among other things, unlawful access to a computer system, unlawful interception of data, interfering with data or systems, acquiring or using passwords and access codes unlawfully, cyber fraud and cyber extortion.
Practical steps that keep privacy possible
Most compromises start with something ordinary: a reused password, a phishing email, a backup that was never tested, a laptop on public Wi-Fi. The safeguards that stop them are equally ordinary:
- Protect the mailbox. Email holds more personal information than any other system in most businesses. Filter spam and phishing, and publish the records (SPF, DKIM and DMARC) that stop others sending mail in your name.
- Use strong, unique passwords and two-factor authentication on every account that matters, starting with email and hosting.
- Back up, off site, and test the restore. A backup that has never been restored is a hope, not a safeguard.
- Encrypt the connection on untrusted networks. On public or shared Wi-Fi, an encrypted tunnel keeps traffic from being read on the way.
- Know your providers. Have the section 21 contract, and know how each provider will tell you about a compromise.
- Write down what you would do if information leaked: who decides, who notifies the Regulator, and how you contact the people affected.
How Noiz helps
The parts that need a decision from you are in our Security group:
- Email Security filters, authenticates and backs up the mail on a domain hosted with Noiz: advanced spam and virus filtering, SPF, DKIM and DMARC kept configured, DNSSEC on the zone, and an email backup that plan backups do not cover.
- Backup is a backup service for your data, sold in the same group.
- VPN gives your devices an encrypted tunnel on untrusted networks.
For more on keeping information private, our journal covers how infostealer malware steals saved passwords and why the new Outlook hands your mailbox to Microsoft.
Sources
Checked 19 October 2026.
The law
- Protection of Personal Information Act 4 of 2013: sections 4, 5, 19, 21 and 22
- Cybercrimes Act 19 of 2020: sections 2 to 12
- Proclamation R. 42 of 2021, commencement of the Cybercrimes Act
Information Regulator
- POPIA page and FAQ
- Annual Report 2024/25, paragraph 2.1.4.2
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
