Security teams in South Africa need a practical way to translate POPIA Section 19 into controls that can be implemented, monitored, and tested.
ISO/IEC 27001:2022 offers a risk-based information security management system (ISMS) that can support this work. This guide focuses on mapping Section 19 requirements to ISO clauses and Annex A controls without treating certification as automatic proof of legal compliance.
1. Identify Personal Information Assets
Section 19(2)(a) requires responsible parties to identify reasonably foreseeable internal and external risks.
Start with an inventory of systems and assets containing personal information:
- Production databases and application servers.
- Cloud storage and backup repositories.
- Employee and customer management systems.
- Application logs and support platforms.
- End-user devices and removable media.
- Third-party platforms processing information.
ISO 27001 controls 5.9 and 5.12 address asset inventory and information classification. These can help security teams identify where personal information is stored and determine the protection required.
Clause 6.1.2 provides the risk assessment process. Threats might include compromised credentials, misconfigured storage, ransomware, accidental disclosure, and unauthorised privileged access.
2. Select Controls Based on Risk
Section 19(2)(b) requires appropriate safeguards to be established and maintained.
Clause 6.1.3 addresses risk treatment, while Annex A provides a reference set of 93 controls.
Examples relevant to personal information include:
| Security concern | ISO 27001:2022 reference |
|---|---|
| Excessive access | 5.15–5.18, 8.2–8.3 |
| Weak authentication | 8.5 |
| Malware and vulnerabilities | 8.7–8.8 |
| Data leakage | 8.12 |
| Missing backups | 8.13 |
| Insufficient logging | 8.15 |
| Limited monitoring | 8.16 |
| Cryptographic protection | 8.24 |
| Privacy and PII protection | 5.34 |
The table is illustrative. The organisation should select controls according to its own risks, document the rationale, and record decisions in the Statement of Applicability.
3. Verify That Controls Actually Work
Section 19(2)(c) requires regular verification of safeguards.
ISO 27001 provides several mechanisms:
- Clause 9.1: Monitoring, measurement, analysis, and evaluation.
- Clause 9.2: Internal audits.
- Clause 9.3: Management reviews.
Useful evidence includes access review results, vulnerability scan reports, penetration test findings, backup restoration tests, incident records, and audit reports.
For example, a policy requiring quarterly access reviews should be supported by records showing that reviews took place, exceptions were investigated, and unnecessary permissions were removed.
4. Connect Incident Response to POPIA
Controls 5.24–5.28 address incident management, including preparation, assessment, response, learning, and evidence collection.
Section 22 of POPIA separately addresses notification after a security compromise. The incident response procedure should therefore identify the notification responsibilities and applicable timing requirements under POPIA rather than relying solely on the generic ISO process.
Controls should also be updated when incident investigations reveal weaknesses. This connects Section 19(2)(d) with ISO 27001 clauses 10.1 and 10.2.
5. Manage Operators and Suppliers
External services may introduce additional risks to personal information.
ISO 27001 controls 5.19–5.22 address supplier security. POPIA Section 21 requires relevant operator arrangements to be documented in writing and establishes responsibilities relating to security safeguards and compromise notification.
Security teams should review supplier access, contractual requirements, data locations, incident escalation, and ongoing assurance.
6. Avoid Treating the Mapping as a Legal Shortcut
ISO 27001 does not cover every POPIA requirement. It does not independently establish lawful processing grounds, satisfy all data subject rights obligations, or determine whether a security compromise must be reported.
A certificate confirms an assessment of an ISMS within its defined scope. It does not automatically prove compliance with every applicable legal obligation.
Implementation Checklist
- Inventory systems containing personal information.
- Assess internal and external security risks.
- Map risks to selected controls.
- Record control selection in the Statement of Applicability.
- Test access, backup, monitoring, and incident procedures.
- Review operator and supplier arrangements.
- Track findings through corrective action.
- Reassess controls when risks change.
Security engineering takeaway: A strong mapping connects each legal obligation to a risk, an implemented control, an owner, and verifiable evidence. Control references are only the starting point; effectiveness is demonstrated through operation and review.
Top comments (0)