SAFEGUARDING DATA UNDER POPIA

Cyber Resilience Requires More Than Good Intentions

Data protection has become one of the most important governance issues facing South African businesses.

Organisations increasingly rely on cloud platforms, artificial intelligence, connected systems and third party service providers. As technology becomes more deeply embedded in everyday operations, the amount of personal and commercially sensitive information moving through these systems continues to grow.

This creates a fundamental compliance challenge.

Having a policy that tells employees how information should be handled is not enough. Organisations also need technical controls that determine what systems, people and applications can actually do.

POPIA and the Security Question

The Protection of Personal Information Act places clear responsibilities on organisations to safeguard personal information against loss, damage, unauthorised access and other forms of unlawful processing.

This means information security cannot sit exclusively with the IT department.

It is a governance issue involving executives, information officers, risk teams, HR, procurement and every employee who handles personal information.

A data breach can expose an organisation to far more than regulatory consequences. It can disrupt operations, damage customer trust, expose confidential information and create significant recovery costs.

Why AI Changes the Conversation

The rapid adoption of artificial intelligence introduces another layer of complexity.

Employees may unknowingly submit confidential information, customer data or commercially sensitive documents into AI systems without fully understanding how that information is processed.

Organisations therefore need to move beyond simply telling employees:

“Do not put confidential information into AI tools.”

Behavioural guidance remains important, but it should be supported by technical and organisational controls.

Access restrictions, data classification, system permissions, monitoring, authentication and appropriate AI governance can help reduce the possibility of inappropriate data exposure.

Building Genuine Cyber Resilience

A resilient organisation assumes that something will eventually go wrong.

The objective is therefore not simply to prevent every incident. It is to ensure that when something does happen, the organisation can detect it, contain it, respond appropriately and continue operating.

Businesses should regularly assess:

• What personal information they hold

• Where that information is stored

• Who has access to it

• Which third parties process it

• What technical controls are in place

• How incidents are detected and reported

• Whether employees understand their responsibilities

• Whether AI usage is governed appropriately

POPIA compliance and cyber resilience are increasingly inseparable.

Does your organisation rely on employees to make the right decision, or have you built systems that help ensure the right decision is made?