Section 19 of the Protection of Personal Information Act (POPIA) is short. Too short. It requires Responsible Parties to "secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures." Two adjectives - appropriate and reasonable - carry the whole weight of the obligation.
The law does not define either. That used to feel like flexibility. After two years of enforcement notices from the Information Regulator, it feels more like a trap.
What "reasonable" looks like in the enforcement record
Pulling the threads of recent notices, five controls turn up again and again as the floor - not the ceiling - of reasonable:
- Multi-factor authentication on all remote and privileged access. Missing MFA on an admin account is the single most-cited finding in breach investigations.
- Centralised logging with 12-month retention. Without logs you cannot tell the Regulator what happened, which turns a contained incident into a full notification event.
- Documented incident response plan that has been tested. Paper plans do not count. Regulator asks when it was last rehearsed.
- Vendor risk review for any processor touching personal information. Operator agreements are required, but recent notices push further - technical due diligence, not just contracts.
- Routine vulnerability scanning with evidence of remediation. Unpatched internet-facing systems have been a direct cause of penalties.
The "appropriate" trap
The same control set is not appropriate for every business. A fintech with card data and a 50-person law firm have very different threat models. The law expects you to match your controls to the risk profile - and to be able to show your working. A risk assessment dated within the last 12 months is the easiest way to do that.
Where most businesses fall short
From the engagements we run, the gap is rarely in the big obvious controls. It's in the joining up:
- There's a firewall, but no one reviews its rules.
- There's an AV, but no one responds to alerts.
- There's an incident plan, but the named Information Officer left in 2025.
- There are backups, but they're on the same AD as the production systems, so ransomware eats them too.
Reasonable is a verb, not a noun. You prove it by running the controls, not by buying them.
What to do this quarter
- Run a risk assessment and map findings to POPIA section 19 and the Regulator's guidance notes.
- Fix the top 3 gaps. Document evidence of remediation.
- Table the result at the next board meeting and record it in the minutes.
That record is what the Information Regulator will ask for when something goes wrong. Better to have it before.
Sources
- Protection of Personal Information Act 4 of 2013 Full text. Section 19 sets the security obligation; section 22 the breach notification duty.
- Information Regulator: enforcement notices The published record this post draws on.
- Information Regulator: POPIA guidance Guidance notes and codes of conduct.
- NIST Cybersecurity Framework A recognised structure for showing "appropriate" controls matched to risk.
- CIS Critical Security Controls The control set we map POPIA findings to in assessments.