The standard: appropriate, reasonable — and yours
“A responsible party must secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent— (a) loss of, damage to or unauthorised destruction of personal information; and (b) unlawful access to or processing of personal information.”
Look at the enforcement record: most actions have been about security failures and breach handling, not about processing without consent. This is the part of POPIA to spend money on. “Technical and organisational” means firewalls and training, encryption and access policies — the password taped to the monitor defeats the best perimeter.
The section 19(2) cycle
Section 19(2) spells out a management cycle, not a shopping list: identify all reasonably foreseeable internal and external risks; establish and maintain appropriate safeguards against them; regularly verify that the safeguards are effectively implemented; and ensure they are continually updated in response to new risks and deficiencies. The verbs are continuous — a security posture is something you run, not something you bought. Regulation 4 adds the organisational layer: a compliance framework and a personal information impact assessment, owned by your information officer.
The R5 million lesson: lapsed licences
The Department of Justice and Constitutional Development was fined R5 million — the first POPIA fine — after the Regulator found its SIEM, intrusion-detection and antivirus licences had lapsed in 2020 and were never renewed, contributing to the September 2021 ransomware loss of about 1 204 files; the Department then failed to comply with the enforcement notice. Read that sequence carefully: the fine punished not the sophistication of the attacker but the mundanity of the failure — renewals nobody owned, followed by a notice nobody actioned. Both failures are organisational, and both are cheap to avoid. The full record is on the enforcement tracker.
The basics that decide cases
- Patch and update — operating systems, applications, firmware; on a cadence, with an owner
- License and renew security tooling — antivirus, monitoring, intrusion detection (the DoJ failure)
- Control access — need-to-know permissions, MFA on remote and admin access, leavers removed same-day
- Back up and test restores — ransomware turns untested backups into decoration
- Train people — phishing remains the front door; TransUnion fell to a weak password
- Contract your operators (s 21) and verify their measures — their breach is your accountability
- Run the regulation 4 personal information impact assessment and keep it current
When prevention fails anyway, the next provision takes over — section 22 breach notification, where the enforcement record shows the second, often costlier, failure happens.