POPIA
South Africa's data-protection law, what it is, and what it actually asks of your business.
What does POPIA stand for?
POPIA stands for the Protection of Personal Information Act (Act 4 of 2013), South Africa's data-protection law. It governs how organisations may collect, use, store and share the personal information of customers, staff and the public.
What is POPIA compliance?
Being POPIA-compliant means processing personal information lawfully across the Act's eight conditions, appointing and registering an Information Officer, genuinely securing the data you hold, and being able to prove all of it if the Information Regulator asks. It's a documented, defensible position, not a box to tick once. See our POPIA compliance audit →
What are the eight conditions of POPIA?
They are: Accountability, Processing Limitation, Purpose Specification, Further Processing Limitation, Information Quality, Openness, Security Safeguards, and Data Subject Participation. Every one has to be met, not just the convenient ones.
When did POPIA come into effect?
POPIA's main provisions commenced on 1 July 2020 with a one-year grace period, becoming fully enforceable on 1 July 2021. It is in force now, and the Information Regulator actively investigates complaints.
How long can you keep personal information under POPIA?
Only for as long as it's genuinely needed for the purpose it was collected, unless a law requires you to keep it longer, or the person consented. Once the purpose ends, the information should be deleted or de-identified rather than kept "just in case".
What are your rights under POPIA?
You can ask what information an organisation holds about you, have it corrected or deleted, object to certain processing, and complain to the Information Regulator. Organisations are required to make these rights easy to exercise, not buried.
What is a breach of confidentiality?
A breach of confidentiality happens when information held in confidence is disclosed to, or accessed by, someone who is not authorised to see it, through a leak, a hack, a lost device or a misdirected email. Under POPIA, an organisation must secure the confidentiality of the personal information it holds (section 19), and any operator processing it on the organisation's behalf must treat it as confidential (section 20). Where there are reasonable grounds to believe personal information was accessed by an unauthorised person, section 22 requires notice to the Information Regulator and the people affected as soon as reasonably possible. The same incident can also breach a contract or a professional duty of confidentiality, such as between doctor and patient or attorney and client. See data breach response →
What must a business do after a data breach under POPIA?
Notify the Information Regulator and the affected people as soon as reasonably possible after discovering a breach that compromises personal information, POPIA sets no fixed number of hours, so work to a tight internal target such as 72 hours. Move fast, document everything, and contain the exposure. See data breach response →
What are the penalties for breaking POPIA?
The Information Regulator can issue enforcement notices and administrative fines of up to R10 million, and serious offences can carry imprisonment, on top of the reputational damage of a public breach.
Cybersecurity & Testing
Finding out where you're exposed, before someone else does.
What is cyber security?
Cyber security (also written cybersecurity) is the practice of protecting computers, networks, software and data from unauthorised access, attack, damage or theft. For a business it combines technology such as firewalls, updates, encryption, backups and multi-factor sign-in, clear processes such as access control and an incident response plan, and people who can spot a phishing email. The aim is to keep information confidential, accurate and available. In South Africa it is also a legal duty: section 19 of POPIA requires reasonable technical and organisational measures to secure personal information. See our cyber security services →
What does penetration testing mean?
Penetration testing, also called pen testing or ethical hacking, means an authorised, simulated attack on your systems by security engineers, run to find and prove exploitable weaknesses before criminals do. You get a prioritised report of real, proven gaps, ranked by business impact, plus the fixes and a retest. See penetration testing →
How much does a penetration test cost in South Africa?
For small businesses and clearly-defined scopes, indicative ranges start from around R15,000; larger corporate and specialised (OT/ICS) engagements are scoped on request. Every engagement is a fixed written quote after a short scoping call, no hourly surprises. See pricing and engagements →
What is network penetration testing?
Testing focused on your network — the external perimeter facing the internet, or the internal network — to find exposed services, weak configurations and the paths an attacker could use to move through your systems and reach your data.
What does a cyber security analyst do?
A cyber security analyst monitors an organisation's systems for threats, investigates alerts, analyses incidents, manages vulnerabilities and helps respond when something goes wrong. Large organisations employ analysts in a security operations centre (SOC). Most small and mid-sized businesses cannot justify a full-time analyst, and one person cannot watch around the clock, so they buy that capability as a service instead: monitoring, investigation and incident response without the hire. See incident response and forensics →
What does a cybersecurity consultant do?
Assesses where you're exposed, maps it to real business risk, and helps you close the gaps — from POPIA and testing to incident response — in language leadership can act on, not just technical jargon. See cyber defence & compliance →
Isn't having antivirus enough?
No. Modern attacks arrive through a convincing email, a reused password or an unpatched service that antivirus never sees, and the first you hear of it is a ransom note. An assessment finds those open doors while they're still cheap to close. See a cybersecurity assessment →
How do I know how exposed we are right now?
Take our free, private security posture self-check. It scores your exposure in about a minute across backups, MFA, patching, training, POPIA readiness and testing, then shows exactly where the gaps are.
IT
What information technology is, and what good IT support looks like.
What is information technology (IT)?
Information technology (IT) is the use of computers, networks, software and data storage to create, process, store and share information. In a business, IT covers the devices your team works on, email and cloud services, the network and internet connection, business software, backups, and the security that protects all of it. See managed IT services →
What does an IT support company do?
An IT support company keeps your technology working and secure so your team does not have to: setting up devices and accounts, monitoring and updating systems, running backups, fixing problems through a helpdesk, and planning upgrades. Managed IT does this proactively for a fixed monthly fee, rather than charging to fix things after they break. See how managed IT works →
Websites & Systems
Building assets you own, not templates you rent.
How much does a website cost in South Africa?
It ranges from a few hundred rand for a DIY builder to R12,000+ for an engineered, fully-owned custom site. The honest question isn't the price. It's whether you're renting a template or owning a business asset. See the honest 2026 pricing guide →
Should I use a website builder or a custom website?
A website builder such as Wix or Squarespace is quick and cheap to start: you rent a template monthly and the platform hosts it, which suits a simple brochure site. A custom-built website costs more upfront, but you own the code, it can do exactly what your business needs, such as bookings, payments and client portals, and it can meet POPIA from the start. Read our website builder comparison →
Do I own the website you build?
Completely. At handover you receive the source code, hosting and data, a permanent asset on your side of the table, never rented or held hostage. See our websites →
What is a business system or client portal?
A custom platform built around how your business actually runs — bookings, secure client portals, documents, dashboards and automation — rather than an off-the-shelf tool you have to bend to fit. See our business systems →
Can I see what you build before committing?
Yes, that's exactly what our live demos are for. Click through a working client portal, re-brand a sample site live, and try a WhatsApp assistant, all in your browser.
AI for Business
Real value from AI: safely, with a human where it matters.
Do you offer AI courses?
Yes. Our AI fluency courses run for business teams, executives, adults and teens, virtually or in person. They cover what AI can and cannot do, choosing between tools and models, using AI safely under POPIA, and measuring the return on it. See AI courses and training →
Can AI really handle my customer service?
For a large share of everyday queries — bookings, FAQs, order status, first-line support — yes, 24/7, with a clean handover to a real person the moment it matters. Try the live assistant →
What is "AI slop", and should I worry about it?
It's AI-generated code or systems that look finished but hide missing security, exposed data or broken logic. If anything in your business was built with AI and never independently reviewed, it's worth checking before it becomes a breach. See AI oversight & remediation →
Is it safe to build my business tools with AI?
Fast, yes; safe, only with oversight. AI ships exposure as easily as it ships features. The value is in an experienced review before it goes live, not after it leaks. See AI consulting & guardrails →
Didn't find your answer? Ask a real person.
You've read the honest version. The next step is a short conversation with an actual engineer — not a call centre, not a bot — who'll tell you straight what you need and what it takes.