POPIA Compliance for IT in South Africa: Your Endpoint Fleet

If you run IT for a South African business, or for forty of them as an MSP, POPIA compliance lands on your desk sooner or later, usually as a client email asking "are we covered?" This is a practical guide to what the Protection of Personal Information Act asks of the machines you manage, what the Information Regulator has actually acted on, and what evidence you should be able to produce on request. I am not a lawyer and this is not legal advice. It is what an operator who builds IT management software has read, checked and understood.

What Section 19 actually says

Section 19 requires a responsible party to take "appropriate, reasonable technical and organisational measures" to prevent loss of, damage to, or unauthorised access to personal information. That is the whole standard. It does not say "patch within 30 days" or "run endpoint detection". It says reasonable, and reasonable depends on what you hold, how sensitive it is and what a prudent organisation of your size would do.

That vagueness is the trap. It means nobody can hand you a checklist that guarantees you are compliant, and it means that after an incident the question is never "did you tick the boxes" but "can you show that what you did was reasonable". Evidence is the product. The controls are only worth what you can prove about them.

What the Regulator has actually punished

Read the enforcement record and a pattern emerges, and it is more mundane than the headlines suggest.

The Department of Justice. After a compromise in September 2021 affecting roughly 1,200 files, the Regulator found the department had let three security licences lapse in 2020: its security event monitoring, its intrusion detection and its antivirus. The Regulator issued an enforcement notice in May 2023 citing Sections 19 and 22. The matter later became a R5 million administrative fine, which the Regulator's own briefing on 31 August 2026 lists as before the courts. The lesson is not that the department was hacked. It is that protection it had paid for had silently stopped running, and nobody noticed for a long time.

SABS. In late August 2026 the Regulator issued an enforcement notice to the South African Bureau of Standards after a 2024 ransomware attack, citing insufficient security safeguards among other findings and giving it 90 days to comply.

The volume. The same briefing reported more than 8,000 security compromise notifications since enforcement began, with over 1,220 in the five months from 1 April 2026. The causes named were inadequate controls, employee negligence, weak passwords, malware and phishing. Those are fleet hygiene problems, not exotic attacks.

Smaller penalties exist too, including R100,000 fines against Lancet Laboratories and the Independent Electoral Commission. Administrative fines can reach R10 million.

Notice what is missing from all of this: a regulator ruling that "your patch window was 45 days and it should have been 14". Nobody has tested that line. What has been tested is whether basic protection was current, whether the organisation knew its own state, and whether it responded properly afterwards. Plan for those three.

The evidence an IT team should be able to produce

Think of this as the file you would want to hand over if the Information Regulator, a client's auditor or an insurer asked. Seven items cover most of it.

1. An inventory you believe. A list of every device that can touch personal information, with owner and location. Not the list on the SLA: the real one. A device you do not know about cannot be reasonable.

2. Patch status with its coverage stated. This is where most reports quietly lie. "96% patched" means nothing until it says 96% of how many devices, scanned when. Our own rule, and the one I would suggest to anyone, is a coverage line on every report: "22 of 25 devices scanned as of a stated date and time, 3 not scanned. Devices not scanned are unknown, not compliant." We wrote more on why a patch calendar is not a risk model in Patch Tuesday Is Not a Strategy, and on what patching should deliver for South African teams in our patch management guide.

3. Proof protection is still running. The Department of Justice case is the template. Antivirus and endpoint protection should be monitored as services with expiry dates, not installed and forgotten. Alert when a licence is within 30 days of expiry, and alert when an agent stops reporting.

4. Encryption on laptops. Laptops leave the building, in a country where theft from cars is a known risk. Record which devices have disk encryption enabled and which do not.

5. Access control. Multi-factor authentication on admin accounts and on anything that reaches client data, with a periodic review of who still has access.

6. A breach response you have rehearsed. Section 22 requires notifying the Information Regulator and the affected people "as soon as reasonably possible" once a compromise is suspected. Since April 2025 the Regulator has expected reports through its eServices portal. Know who files it, who writes to the affected people, and where the phone numbers are, before the day you need them.

7. Written contracts with every operator. Section 21 makes this one frequently missed. If another party processes personal information on your behalf, you need a written contract requiring them to apply the same safeguards, and you remain accountable regardless.

If you are an MSP, you are the operator

For an MSP managing clients' machines, the client is typically the responsible party and you are the operator. Section 21 means your clients should have a written agreement with you covering security measures and notification of compromises. Your RMM and PSA are themselves tools that process and can reach personal information, which means your clients are entitled to ask how you secure them, and a good client will.

This is also where choosing a platform matters for reasons beyond price. A tool that keeps data in a clear jurisdiction, bills in rands and can show its own audit trail makes your side of that conversation simpler. We covered what to look for in our guide to RMM software in South Africa, and how RMM and PSA fit together in RMM vs PSA explained.

What Allocentra does here, and what it does not

Honesty matters more than a sales line on a topic like this, so plainly:

• We are small. Allocentra is a South African company based in Sandton, pre-revenue, with one production customer today. If you need a vendor with a decade of audited track record, we are not that yet.
• We find missing Windows updates and roll them out in rings. Our reports carry the coverage line described above, so a device we did not reach shows as unknown rather than compliant.
• We do not make you POPIA compliant. No software does. Compliance is a set of decisions, contracts and habits. A tool can give you the evidence for some of them and the alerts for others.
• We do not guarantee zero vulnerabilities. We guarantee an honest account of what we scanned. If you want to see what your own estate looks like, there is a free Patch Exposure Audit: our agent on 25 of your endpoints and a report in 48 hours. You keep the report whether or not you become a customer. You can start a trial, look at pricing or talk to us.

FAQ

Does POPIA require patching? POPIA does not mention patching by name. Section 19 requires appropriate, reasonable technical and organisational measures to protect personal information, and running unpatched software known to be exploited is difficult to defend as reasonable. Treat timely patching as an expected part of those measures and keep records of it.

What are the penalties for not complying with POPIA? The Information Regulator can issue administrative fines of up to R10 million, and certain offences carry criminal penalties. Fines issued so far have ranged from R100,000 to R5 million, and the largest are currently being contested in court.

Do I have to report a data breach to the Information Regulator? Yes. Section 22 requires the responsible party to notify the Regulator and the affected data subjects as soon as reasonably possible after a security compromise. The Regulator has directed reports through its eServices portal since April 2025.

Is an MSP responsible for its clients' POPIA compliance? Usually the client is the responsible party and the MSP is an operator. Under Section 21 there must be a written contract requiring the operator to maintain security safeguards, and the client stays accountable. The MSP still has its own duties as an operator, so both sides should understand the split.

What evidence do I need to show POPIA compliance for IT? At minimum: a trusted device inventory, patch status with coverage stated, proof that endpoint protection is current, encryption status for laptops, access control records, a rehearsed breach response and written operator contracts.

Does Allocentra make my business POPIA compliant? No. Allocentra gives IT teams and MSPs patching, monitoring and reporting that can support your evidence, but compliance depends on your own policies, contracts and decisions, and you should take legal advice for your specific situation.