POPIA security safeguards for a small business
What security measures POPIA's section 19 expects a South African small business to take over personal information, and how to keep them current.
By Achekam · · 5 min read · For Running a business businesses in South Africa
A small business rarely thinks of itself as holding sensitive data. Then it lists what is actually on its systems: customers' ID numbers and addresses, staff bank details and medical aid information, supplier contracts, perhaps CCTV footage. All of it is personal information, and all of it would hurt someone if it leaked.
POPIA does not give small businesses a lighter version of the duty to protect that information. What it does is describe the duty in terms of what is reasonable and appropriate, which leaves room to size the response to the business. This article explains what section 19 asks for, the cycle of identifying risks and maintaining safeguards that sits at its centre, why size does not exempt anyone, and the controls Achekam offers for the part of your information kept there.
Reasonable technical and organisational measures
The POPIA text published on the government's page requires a responsible party to secure personal information with appropriate, reasonable technical and organisational measures. That is section 19 of the Act as published in 2013. The government's page records that most of the Act, including sections 2 to 38 and 55 to 109, commenced on 1 July 2020, so these duties have applied for some years.
Two kinds of measure are named:
- Technical measures are things systems do: sign-in controls, restricted access, checks on files, backups.
- Organisational measures are things people do: who is allowed to see what, how staff are trained, what happens when someone leaves, how paper files are stored.
A small business usually needs both. The strongest password policy does not help if the customer list is printed and left on the reception desk.
The government's page for the Protection of Personal Information Act carries the Act as published and its commencement notices, and section 19 is short enough to read in full.
Identify risks, maintain safeguards, verify and update them
Section 19 does not stop at "have safeguards". As published, it says the measures include identifying foreseeable risks, maintaining safeguards against them, and regularly verifying and updating them. That is a cycle, not a one-off task.
A practical version for a small business:
- Identify. List where personal information sits: the accounting system, e-mail, shared drives, phones, paper files. For each, ask what could reasonably go wrong.
- Safeguard. For each risk, decide what you will do: restrict access, require two-factor sign-in, lock the filing cabinet, remove old data.
- Verify. Check periodically that the safeguards are actually in place and working. Are former staff still able to sign in? Is two-factor sign-in really switched on for everyone?
- Update. When the business changes, through a new system, a new office or new staff, go back to step one.
Write each round down, with a date. If something does go wrong, a record of a working cycle is the best evidence that the business took its duty seriously.
Every organisation, whatever its size
The Information Regulator says any organisation, public or private and irrespective of its size, or any individual that processes personal information, is a responsible party with a duty to comply with POPIA's eight conditions for lawful processing. Security is one part of that duty.
Size affects what is reasonable, not whether the duty applies. And the consequences of a failure do not shrink with the business. The POPIA text published on the government's page, in section 22, requires a responsible party that has reasonable grounds to believe personal information was accessed or acquired by an unauthorised person to notify the Information Regulator and the data subject as soon as reasonably possible. How that works is covered in reporting a data breach to the Information Regulator.
Sign-in controls, IP allowlists and role permissions in Achekam
For the information a business keeps in Achekam, several technical measures are available.
Two-factor sign-in. Users can turn on two-factor sign-in with an authenticator app, and a business can require it for all of its members. Members can also sign in with Google or Microsoft Entra ID once single sign-on has been set up. These controls are under SETTINGS, in Security & SSO. Requiring two-factor sign-in for everyone, rather than leaving it to each user, is the stronger choice. More detail is in two-factor sign-in and single sign-on.
Your rules apply to your accountant too. A member of an accounting firm who opens a business's books must meet that business's own IP allowlist and two-factor rules. So if you restrict access to your office network and require two-factor sign-in, the outside firm working in your books is held to the same rules.
Role permissions. A business can allow or deny what each role may do, check why a member may or may not act, and grant named permissions per role or per person, under SETTINGS, in Permissions & RBAC. That is the technical side of "who is allowed to see what": a sales assistant need not see payroll, and a bookkeeper need not see the customer marketing list.
Checks on uploaded files
Files bring their own risks. In Achekam, every stored file gets a SHA-256 fingerprint, executable files are refused by default, and every upload passes a malware check. That check uses ClamAV when the server is configured for it; otherwise a built-in heuristic check runs.
That is the full list of file controls described here, and it is worth being precise about them rather than generous. They do not replace the organisational side: deciding which documents with personal information should be uploaded at all, who may open them, and when they should be removed.
Run the cycle once this quarter
Set aside time this quarter for one full round: list where personal information sits, note the risks, check that two-factor sign-in and role permissions are set as you intend, and write down what you changed. Then put the next round in the diary. Section 19 asks for safeguards that are maintained, and a dated record of each round is how you show they were.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
