Duo IT
Language and country: ENZA
Nederland · duo-it.nlNederlandsEnglish
South Africa · Suid-Afrika · duo-it.co.zaEnglishAfrikaans
Book an IT audit
POPIA guide · updated October 2026

POPIA and your IT,
in plain language.

What POPIA asks of your business, how breach reporting to the Information Regulator works and how to get ready. Written for business directors, without legal jargon. By Duo IT Solutions, IT partner in Cape Town.

POPIA · Protection of Personal Information Act

POPIA already applies to you. Would you survive a breach report?

If your business holds client or staff details, POPIA applies, whatever your size. Since April 2025, a security breach must be reported to the Information Regulator through its eServices portal, and everyone affected must be told. Duo IT Solutions makes businesses of any size POPIA-ready, without you having to hire a security team.

The Information Regulator Expects appropriate security, and a report after any breach
Your business Must show your IT is secure and recoverable
Duo IT Security, backups and 24/7 monitoring, documented in reports

What POPIA asks, in plain language

A front door that stays shut

POPIA asks
Appropriate, reasonable technical measures to protect personal information (section 19)
What it means for you
Nobody gets in unnoticed, not through a remote worker and not through another branch.
What we do
We install an enterprise firewall that blocks suspicious traffic and links your sites with encryption.

FortiGate clusters · ZTNA · IPS · encrypted site-to-site tunnels

Only the right people get in

POPIA asks
Prevent unauthorised access to personal information (section 19)
What it means for you
A stolen password isn't enough to sign in, and every laptop is up to date.
What we do
We enforce two-step sign-in, link that login to your VPN and cloud apps with single sign-on, decide who can access what and install updates automatically.

Microsoft 365 · Entra ID · MFA · SSO · conditional access · RMM patch management · ESET

After an attack, you're back to work fast

POPIA asks
Prevent loss of, or damage to, personal information (section 19)
What it means for you
Even if ransomware strikes, your data is safe and you know how long recovery takes.
What we do
We deploy right-sized resilience, from hybrid Veeam setups to appliance-free cloud-to-cloud backups. Always immutable, kept off the network, with verified restore tests.

Hybrid Veeam & cloud-to-cloud · immutable storage · tested RTO/RPO

Someone is watching, day and night

POPIA asks
Report a security compromise as soon as reasonably possible (section 22)
What it means for you
A breach is spotted straight away, contained and reported correctly.
What we do
Our 24/7 Network Operations Centre watches everything and helps you file the report on the Regulator's portal.

24/7 NOC · agent and SNMP telemetry · incident reporting

POPIA in three numbers

R10 million

Maximum administrative fine under POPIA. Source: POPIA s109

R5 million

What the Regulator fined the Department of Justice after its antivirus and security licences lapsed. Source: SAnews

R17 million

Average ransomware recovery cost in South Africa, before any ransom. Source: Sophos 2026

Supplying banks, insurers or financial services providers?

Since 1 June 2025, Joint Standard 2 requires them to set out security responsibilities in their contracts with suppliers. Expect a security questionnaire. Source: Michalsons

Selling to Europe?

European customers under NIS2 must check their suppliers, including suppliers in South Africa. Our Dutch side knows exactly what they will ask, and our Cape Town team gets you there.

Preview of the POPIA Reality Check PDF · 1 page
Free download · 5 minutes

POPIA already applies to you. Every breach must be reported. Would you pass?

The POPIA Reality Check: the 7 questions you will face from the Regulator and your customers, the numbers every director should know and a score that tells you honestly where you stand.

  • Facts from the Information Regulator, Sophos and POPIA itself
  • 7 questions with a scorecard
  • What a breach costs, in rand

We never share your details with anyone, and we process them in line with POPIA.

No in-house security department needed.

We deliver the complete, co-managed security POPIA expects, under one predictable monthly fee.

Scope

Who must comply with POPIA?

Unlike NIS2 in Europe, POPIA has no size threshold. If you process personal information in South Africa, it applies to you, from a 10-person practice to a factory with three branches.

What POPIA expects from every business

Protection of Personal Information Act 4 of 2013
  • Security safeguards: appropriate, reasonable technical and organisational measures (section 19)
  • Your IT provider: anyone processing data for you must tell you about a breach immediately (section 21)
  • Breach reporting: to the Information Regulator and the people affected, as soon as reasonably possible (section 22)
  • An Information Officer, registered with the Information Regulator

Where the pressure comes from

Regulator, customers and Europe
  • The Information Regulator: administrative fines of up to R10 million (section 109)
  • Financial institutions: Joint Standard 2 has applied to banks, insurers and their suppliers since 1 June 2025
  • European customers: NIS2 makes them check suppliers, including South African ones
  • Your clients: every breach must be explained to the people whose data it was
R17m

Average ransomware recovery cost in South Africa in 2026, before any ransom is paid. 63% of attacks there ended with data encrypted, above the global average of 56%. Source: Sophos, State of Ransomware in South Africa 2026.

Sources: Covington on the eServices portal (2025), Michalsons on Joint Standard 2, TimesLIVE on Sophos 2026. This is not legal advice.

Frequently asked questions

Short and clear.

Question not listed? Feel free to email us.

What does Duo IT Solutions do?

Duo IT Solutions is an IT partner with one team in Cape Town and the Utrecht region in the Netherlands. We manage, secure and monitor the entire IT of organisations of any size and complexity, with senior expertise and 24/7 monitoring.

Does POPIA apply to my business?

Almost certainly. POPIA applies to any business that processes personal information about clients, suppliers or staff, whatever its size. It requires appropriate security measures, and a security breach must be reported to the Information Regulator, as soon as reasonably possible, through its eServices portal. A 30-minute POPIA check tells you where you stand.

We supply banks and insurers, or sell to Europe. What will they ask?

More and more about your security. Since 1 June 2025, Joint Standard 2 requires financial institutions to set out security responsibilities in their contracts with suppliers. European customers under NIS2 must check their suppliers too, including suppliers in South Africa. Working from Cape Town and Utrecht as one team, we know what both will ask and help you answer it.

Can our people use ChatGPT or other AI tools?

Yes, as long as it's done safely. We set up one business AI tool tied to your company login, on terms where your data isn't used to train models. Free AI tools and personal accounts are blocked at the FortiGate firewall, and files with client or staff data are stopped before they leave the network.

Can you limit social media and streaming at work?

Yes. With web filtering on a next-generation firewall you decide per category what's allowed: business apps always, with priority; streaming and social media closed or only at break time; gambling and harmful sites never. We set it up transparently and in line with POPIA, and you get a clear overview every month.

What is co-managed IT?

Your own IT person keeps handling the day-to-day. We provide the senior expertise, the 24/7 platform and the escalation for security, cloud and network. Your IT person gets backup, and your company isn't exposed when they're on leave.

Can you take over our existing IT?

Yes. We take over existing hardware and networks with no forced replacement, including VMware, Linux, Cisco, HP/Aruba and Dell. Then we bring you to our proven standard in a structured pipeline, without disrupting your work. Within 90 days, a FortiGate firewall, ESET antivirus and spam filtering and onboarding onto our RMM platform are always in place. Legacy systems may take longer.

Do you offer a free security audit?

Yes. As part of our comprehensive security and network audit, and with your permission, we connect a passive FortiGate sensor to your network and analyse all traffic for seven days. It runs in monitor mode, so there is zero downtime and zero obligation. You get a report on internal threats, external exposure, incoming attacks and unfiltered content such as adult content, torrenting and crypto-mining.

Do you set up MFA and single sign-on?

Yes. We enforce MFA on every Microsoft 365 account and connect that same login to your remote-worker VPN and your other company cloud apps. Everyone uses single sign-on: one secure login for everything, fewer passwords and maximum security.

How fast do you respond to an outage?

For a critical outage (P1) we respond within 15 minutes. Our Network Operations Centre monitors your environment 24/7, so we're often already on it before you notice.

Can you take care of our phones too?

Yes. We deliver business telephony with 3CX in the cloud, with Yealink desk phones or the app on laptop and smartphone. Lines run through established South African carriers. Because we also manage your network and firewall, calls get priority and you have one point of contact when something isn't working.

What does it cost?

A predictable monthly fee, matched to your environment. After the audit you get a proposal with a fixed scope, with no surprises afterwards.

IT audit

Book your no-obligation IT audit.

Whether you want to tidy up scattered IT, secure your network or bring everything under 24/7 oversight, we'd be glad to talk it through.

  1. 01

    Introduction and POPIA check, 30 minutes

    We hear what's going on and how we can help.

  2. 02

    An audit of your environment

    On site or remote. Want the full picture? With your permission, we monitor your network for 7 days with a passive FortiGate sensor, free and with zero downtime. You get a clear report, whatever you decide.

  3. 03

    A bespoke proposal

    Predictable monthly costs, a clear point of contact and a start date.

We take on a limited number of new clients at a time. Request your audit early.
Duo IT SolutionsCape Town · South Africa
Email us directly
dante@duo-it.co.za
Book the IT audit LinkedIn company page

Active from Cape Town to Amsterdam, for clients of every size.

Already a client? Go to the helpdesk.