What POPIA asks of your business, how breach reporting to the Information Regulator works and how to get ready. Written for business directors, without legal jargon. By Duo IT Solutions, IT partner in Cape Town.
POPIA already applies to you. Would you survive a breach report?
If your business holds client or staff details, POPIA applies, whatever your size. Since April 2025, a security breach must be reported to the Information Regulator through its eServices portal, and everyone affected must be told. Duo IT Solutions makes businesses of any size POPIA-ready, without you having to hire a security team.
The Information Regulator
Expects appropriate security, and a report after any breach
asks for proof
Your business
Must show your IT is secure and recoverable
we deliver the proof
Duo IT
Security, backups and 24/7 monitoring, documented in reports
What POPIA asks, in plain language
A front door that stays shut
POPIA asks
Appropriate, reasonable technical measures to protect personal information (section 19)
What it means for you
Nobody gets in unnoticed, not through a remote worker and not through another branch.
What we do
We install an enterprise firewall that blocks suspicious traffic and links your sites with encryption.
Prevent unauthorised access to personal information (section 19)
What it means for you
A stolen password isn't enough to sign in, and every laptop is up to date.
What we do
We enforce two-step sign-in, link that login to your VPN and cloud apps with single sign-on, decide who can access what and install updates automatically.
Microsoft 365 · Entra ID · MFA · SSO · conditional access · RMM patch management · ESET
After an attack, you're back to work fast
POPIA asks
Prevent loss of, or damage to, personal information (section 19)
What it means for you
Even if ransomware strikes, your data is safe and you know how long recovery takes.
What we do
We deploy right-sized resilience, from hybrid Veeam setups to appliance-free cloud-to-cloud backups. Always immutable, kept off the network, with verified restore tests.
What the Regulator fined the Department of Justice after its antivirus and security licences lapsed. Source: SAnews
R17 million
Average ransomware recovery cost in South Africa, before any ransom. Source: Sophos 2026
Supplying banks, insurers or financial services providers?
Since 1 June 2025, Joint Standard 2 requires them to set out security responsibilities in their contracts with suppliers. Expect a security questionnaire. Source: Michalsons
Selling to Europe?
European customers under NIS2 must check their suppliers, including suppliers in South Africa. Our Dutch side knows exactly what they will ask, and our Cape Town team gets you there.
PDF · 1 page
Free download · 5 minutes
POPIA already applies to you. Every breach must be reported. Would you pass?
The POPIA Reality Check: the 7 questions you will face from the Regulator and your customers, the numbers every director should know and a score that tells you honestly where you stand.
Facts from the Information Regulator, Sophos and POPIA itself
7 questions with a scorecard
What a breach costs, in rand
No in-house security department needed.
We deliver the complete, co-managed security POPIA expects, under one predictable monthly fee.
Unlike NIS2 in Europe, POPIA has no size threshold. If you process personal information in South Africa, it applies to you, from a 10-person practice to a factory with three branches.
What POPIA expects from every business
Protection of Personal Information Act 4 of 2013
Security safeguards: appropriate, reasonable technical and organisational measures (section 19)
Your IT provider: anyone processing data for you must tell you about a breach immediately (section 21)
Breach reporting: to the Information Regulator and the people affected, as soon as reasonably possible (section 22)
An Information Officer, registered with the Information Regulator
Where the pressure comes from
Regulator, customers and Europe
The Information Regulator: administrative fines of up to R10 million (section 109)
Financial institutions: Joint Standard 2 has applied to banks, insurers and their suppliers since 1 June 2025
European customers: NIS2 makes them check suppliers, including South African ones
Your clients: every breach must be explained to the people whose data it was
R17m
Average ransomware recovery cost in South Africa in 2026, before any ransom is paid. 63% of attacks there ended with data encrypted, above the global average of 56%. Source: Sophos, State of Ransomware in South Africa 2026.
Duo IT Solutions is an IT partner with one team in Cape Town and the Utrecht region in the Netherlands. We manage, secure and monitor the entire IT of organisations of any size and complexity, with senior expertise and 24/7 monitoring.
Does POPIA apply to my business?
Almost certainly. POPIA applies to any business that processes personal information about clients, suppliers or staff, whatever its size. It requires appropriate security measures, and a security breach must be reported to the Information Regulator, as soon as reasonably possible, through its eServices portal. A 30-minute POPIA check tells you where you stand.
We supply banks and insurers, or sell to Europe. What will they ask?
More and more about your security. Since 1 June 2025, Joint Standard 2 requires financial institutions to set out security responsibilities in their contracts with suppliers. European customers under NIS2 must check their suppliers too, including suppliers in South Africa. Working from Cape Town and Utrecht as one team, we know what both will ask and help you answer it.
Can our people use ChatGPT or other AI tools?
Yes, as long as it's done safely. We set up one business AI tool tied to your company login, on terms where your data isn't used to train models. Free AI tools and personal accounts are blocked at the FortiGate firewall, and files with client or staff data are stopped before they leave the network.
Can you limit social media and streaming at work?
Yes. With web filtering on a next-generation firewall you decide per category what's allowed: business apps always, with priority; streaming and social media closed or only at break time; gambling and harmful sites never. We set it up transparently and in line with POPIA, and you get a clear overview every month.
What is co-managed IT?
Your own IT person keeps handling the day-to-day. We provide the senior expertise, the 24/7 platform and the escalation for security, cloud and network. Your IT person gets backup, and your company isn't exposed when they're on leave.
Can you take over our existing IT?
Yes. We take over existing hardware and networks with no forced replacement, including VMware, Linux, Cisco, HP/Aruba and Dell. Then we bring you to our proven standard in a structured pipeline, without disrupting your work. Within 90 days, a FortiGate firewall, ESET antivirus and spam filtering and onboarding onto our RMM platform are always in place. Legacy systems may take longer.
Do you offer a free security audit?
Yes. As part of our comprehensive security and network audit, and with your permission, we connect a passive FortiGate sensor to your network and analyse all traffic for seven days. It runs in monitor mode, so there is zero downtime and zero obligation. You get a report on internal threats, external exposure, incoming attacks and unfiltered content such as adult content, torrenting and crypto-mining.
Do you set up MFA and single sign-on?
Yes. We enforce MFA on every Microsoft 365 account and connect that same login to your remote-worker VPN and your other company cloud apps. Everyone uses single sign-on: one secure login for everything, fewer passwords and maximum security.
How fast do you respond to an outage?
For a critical outage (P1) we respond within 15 minutes. Our Network Operations Centre monitors your environment 24/7, so we're often already on it before you notice.
Can you take care of our phones too?
Yes. We deliver business telephony with 3CX in the cloud, with Yealink desk phones or the app on laptop and smartphone. Lines run through established South African carriers. Because we also manage your network and firewall, calls get priority and you have one point of contact when something isn't working.
What does it cost?
A predictable monthly fee, matched to your environment. After the audit you get a proposal with a fixed scope, with no surprises afterwards.
IT audit
Book your no-obligation IT audit.
Whether you want to tidy up scattered IT, secure your network or bring everything under 24/7 oversight, we'd be glad to talk it through.
01
Introduction and POPIA check, 30 minutes
We hear what's going on and how we can help.
02
An audit of your environment
On site or remote. Want the full picture? With your permission, we monitor your network for 7 days with a passive FortiGate sensor, free and with zero downtime. You get a clear report, whatever you decide.
03
A bespoke proposal
Predictable monthly costs, a clear point of contact and a start date.
We take on a limited number of new clients at a time. Request your audit early.