POPIA's Condition 7 requires "appropriate, reasonable technical and organizational measures" to secure personal information — but the Act deliberately doesn't hand you a checklist. That ambiguity is often mistaken for flexibility to do the bare minimum. In practice, regulators and courts look to established industry standards to judge what's "reasonable." Here's where to start.
Encryption: The Non-Negotiable Baseline
Encrypting personal information, both at rest and in transit, is one of the clearest ways to demonstrate reasonable security measures. If encrypted data is stolen but the keys are not, the practical harm to data subjects is dramatically reduced — and some breach notification obligations may even be softened as a result, since the information remains unintelligible to unauthorized parties.
Priority areas for encryption: - Databases holding ID numbers, financial details, or health information - Backups (a frequently overlooked weak point) - Data transmitted between systems, apps, and third parties - Laptops, mobile devices, and removable media
Access Control: Limiting the Blast Radius
Not everyone in your organization needs access to all personal information. POPIA's principle of "minimality” collecting and retaining only what's necessary — extends naturally to access: staff should only reach the data required for their role.
Practical measures include: - Role-based access control (RBAC) tied to job function - Multi-factor authentication (MFA) for any system holding personal information - Regular access reviews to remove permissions from former employees or changed roles - Logging and monitoring of who accessed what, and when
Why This Combination Matters
Encryption protects data if perimeter defenses fail. Access control reduces how much damage an attacker — or a careless insider — can do even after getting in. Together, they form a layered defense that satisfies both the letter and spirit of POPIA's security condition.
A Common Mistake
Many businesses encrypt customer-facing data but neglect internal systems — HR records, internal chat exports, spreadsheets shared over email. POPIA doesn't distinguish between "customer data" and "internal data" when it comes to personal information; an employee's ID number sitting in an unprotected spreadsheet is just as much a compliance risk as a customer database.
Getting Started
If you're unsure where you stand, begin with a data mapping exercise: identify where personal information lives, who can access it, and whether it's encrypted. This single exercise typically reveals the majority of your immediate risk — and gives you a prioritized list of what to fix first.
---
Want this handled properly, not just understood? Innovo Networks builds and manages exactly this — talk to a specialist about your setup.
Get a Quote