POPIA compliance for Johannesburg SMEs.
Most IT firms bolt compliance on. We start there. POPIA is mostly a controls problem, not a paperwork problem — and controls are IT. We build them in from day one.
Controls, not paperworkControls we put in place
The part that actually protects you — and the part most firms skip.
- Access management: named accounts, least-privilege, same-day leaver process
- MFA enforced on email, storage and anything holding personal data
- Full-disk encryption by policy, not left to chance
- Device and endpoint hardening across the fleet
- Secure configuration of your cloud tenant and storage
Readiness & process
The written layer — describing what is in place, and what to do when something goes wrong.
- Breach-response readiness — written, before you need it
- Data-subject-request handling that works in practice
- A processor register, kept current
- Clear, plain-language policies that match reality
- Evidence you can show, not promises you cannot
Compliance as controls — which is to say, as IT.
Common questions.
Straight answers, the way we would give them on a first call.
Is POPIA actually mandatory for a small business?
Yes. POPIA applies to almost any South African business that processes personal data — staff, customer or supplier — regardless of size. The risk is real: fines, and reputational damage if a breach is handled badly.
Is POPIA not just paperwork and policies?
Most of it is controls, not paperwork — and controls are IT. Access management, MFA, encryption and breach readiness are the substance. We start there, then the documentation describes what is actually in place.
What do you actually put in place?
Named accounts with least-privilege access and a same-day leaver process, MFA enforced on anything holding personal data, full-disk encryption by policy, a written breach-response plan, and data-subject-request handling with a processor register.
What happens if we have a data breach?
You want the answer written before you need it. We prepare a breach-response plan in advance — who is notified, in what order, and within what timeline — so a bad day does not become a compliance failure.
Do we need a separate compliance consultant as well?
Usually not for the IT side. Because POPIA is largely a controls problem, your IT partner is the right place for most of it. For legal interpretation edge-cases we will tell you honestly when to bring in a specialist.
Send us your situation.
Tell us where your compliance sits today. We will tell you, plainly, what we would do about it.
Engineer-run · 4-hour written SLA · Month-to-month, no lock-in