Four years into full enforcement, the Protection of Personal Information Act is no longer a compliance project that businesses can defer to next quarter. The Information Regulator is actively investigating, issuing enforcement notices, and imposing fines. The question for South African business owners has shifted from “do we need to comply?” to “how do we prove that we do?”
The answer to that question requires more than a privacy policy buried in the footer of your website.
What POPIA Actually Requires
POPIA governs how any organisation collects, stores, uses, shares, and ultimately disposes of personal information belonging to natural persons. This applies to every business in South Africa regardless of size, sector, or whether you think you handle “significant” amounts of personal data.
If you store client names and contact details, you process personal information. If you send email marketing, you process personal information. If you use a third-party cloud system that holds employee records, you process personal information and you are responsible for ensuring that third party does so lawfully on your behalf.
The eight conditions for lawful processing under POPIA are the foundation of compliance: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. Each condition translates into practical obligations that need to be embedded into your business operations not just documented in a policy.
The 2025 Amendments Raised the Bar on Breach Reporting
The 2025 Amendment Regulations introduced one particularly important change that every business owner needs to understand: all security compromises must be reported. Not just “significant” breaches. Not just breaches affecting a threshold number of individuals. All of them to the Information Regulator and to the affected data subjects, as soon as you are reasonably certain that a breach has occurred.
This has significant operational implications. You need to know when a breach has occurred. You need the systems and monitoring capability to detect it. You need a documented incident response process that can be activated quickly. And you need to know exactly what data was affected, who it belongs to, and how to notify them.
Most businesses we engage with do not have this capability in place. They are unaware of breaches until long after the fact or they discover them through external notification rather than internal detection.
Enforcement Is No Longer Theoretical
The Information Regulator has moved well beyond issuing guidance. Recent enforcement actions against both large and small organisations demonstrate that non-compliance carries real consequences.
Administrative fines of up to R10 million are available. Criminal liability including imprisonment for serious offences applies to individuals, not just entities. Directors and officers can be personally prosecuted. And beyond the formal penalties, civil claims from affected data subjects and the reputational impact of a publicly disclosed enforcement action can be far more damaging than the fine itself.
Critically, a new compliance monitoring programe has been introduced that requires organisations to demonstrate ongoing compliance through documentation, internal controls, and governance processes. This is a shift from reactive enforcement to active supervision and businesses that are not ready will be exposed.
Practical Steps for SME Business Owners
POPIA compliance does not need to be overwhelming. For most SMEs, the priority actions are clear:
Appoint an Information Officer. This is a legal requirement. The Information Officer is responsible for ensuring the business complies with POPIA and must be registered with the Information Regulator. In practice, this is often the business owner, a senior manager, or an outsourced compliance function.
Map your data. You cannot protect what you cannot see. Understand what personal information you collect, where it is stored, how it flows through your business, who has access to it, and how long you retain it.
Formalise your policies and contracts. A POPIA-compliant privacy notice, data retention policy, and operator agreements with your third-party service providers are baseline requirements — not optional extras.
Implement security safeguards. POPIA requires “reasonable measures” to protect personal information. What is reasonable depends on the sensitivity of the data and the size of your organisation but it always includes access controls, encryption of sensitive data, and a patch management programme for your systems.
Have a breach response plan. Know what you will do if a breach occurs. Who gets notified internally? What is the timeline for notifying the Regulator? Who drafts the notification to affected individuals?
Compliance and Security Are Inseparable
One of the most important insights for business owners is that POPIA compliance and IT security are not separate conversations. The security safeguards required by POPIA access controls, encryption, monitoring, breach detection are the same controls your IT environment needs to resist attack.
At RubiBlue, our Governance, Risk & Compliance practice works alongside our Managed IT and Cyber Security teams specifically because these disciplines are interconnected. A business that has robust IT security is well on its way to POPIA compliance. A business that has implemented POPIA controls has a more secure IT environment.
The businesses that treat compliance as an isolated legal obligation, and security as a separate IT concern, end up doing twice the work for half the protection.
RubiBlue provides compliance and risk management solutions for regulated service providers and businesses that process personal information across South Africa. Talk to our team about a POPIA readiness assessment.
