Section 19 of POPIA places an obligation on a responsible party to secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent loss, damage to, or unauthorised destruction of, and unlawful access to, personal information.

To comply with this obligation, the responsible party must take reasonable measures to do all of the following: 

• Identify all reasonably foreseeable internal and external risks to personal information under its control;
• Establish and maintain appropriate safeguards against the risks identified;
• Regularly verify that the safeguards are effectively implemented; and
• Ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.

The responsible party must also have due regard to generally accepted information security practices and procedures which may apply to it generally or be required in terms of specific industry or professional rules and regulations.