POPIA and Your Backups: How South African Businesses Should Protect and Recover Data in 2026

POPIA's security safeguards condition (section 19) requires a responsible party to secure the integrity and confidentiality of personal information by taking "appropriate, reasonable technical and organisational measures" to prevent loss, damage and unlawful access. Losing customer or employee records to ransomware - with no way to recover them - is exactly the kind of loss the Act has in mind.

Backups cut both ways. They are your recovery mechanism, but they are also copies of personal information. That means they need the same care as production data: access control, encryption, sensible retention and a clear record of where they are stored.

Section 22 adds another dimension: if personal information is accessed or acquired by an unauthorised person, you must notify the Information Regulator and affected data subjects. A tested recovery plan won't prevent a breach, but it dramatically reduces the damage and the time your business spends offline.

The classic 3-2-1 rule has been updated for the ransomware era. Today's benchmark is 3-2-1-1-0:

• 3 copies of your data - production plus at least two backups.
• 2 different types of storage media, so a single failure type can't take out everything.
• 1 copy offsite, physically separated from your main premises.
• 1 copy that is offline, air-gapped or immutable.
• 0 errors after automated recovery verification.

The last two numbers are where most South African businesses fall short. Many have an offsite copy, but it's reachable with the same administrator credentials an attacker would steal. And very few verify that backups actually restore until the day they need them.

An immutable backup is a copy that cannot be modified or deleted for a defined period - not by a user, not by an administrator and not by malware running with stolen credentials. In a Veeam environment this is typically achieved with a hardened Linux repository or object storage with object-lock enabled.

Modern ransomware attacks follow a familiar pattern: gain access, quietly escalate privileges, find and delete or encrypt the backups, then encrypt production. Immutability breaks that chain. Even if the attacker controls your network, the protected copy survives.

Recovery also needs to be clean. Restoring infected systems simply restarts the attack. Good practice includes scanning backups before restore, keeping several restore points and restoring into an isolated network first. These steps should be written into your disaster recovery plan, not improvised during a crisis.

What to ask your current provider

• Which of our backup copies are immutable, and for how long?
• Could someone with our domain admin password delete our backups?
• When did we last perform a full test restore, and what was the result?

POPIA doesn't prohibit storing data outside South Africa, but section 72 places conditions on cross-border transfers: the recipient must be bound by laws, rules or agreements that provide an adequate level of protection, or another lawful basis must apply. For many organisations, the simplest answer is to keep backup and DR copies in-country.

That is now very practical. Microsoft Azure, AWS and a range of local providers operate data centres in Johannesburg and Cape Town. Backup-as-a-Service and Disaster-Recovery-as-a-Service offerings hosted in South Africa give you an offsite, separately administered copy without the cross-border question.

Local hosting also helps recovery speed. Restoring terabytes across an undersea cable is slower than pulling them from a facility a few hundred kilometres away.

A disaster recovery plan that has never been tested is a hope, not a plan. Testing tells you three things you can't learn any other way: whether the backups restore, how long recovery really takes and what was forgotten in the documentation.

A sensible testing programme for a mid-sized organisation looks like this:

1. Automated restore verification after every backup job (Veeam SureBackup does this well).
2. Quarterly file and application restores for key systems such as ERP, finance and email.
3. A full failover test at least twice a year for critical workloads, measuring actual recovery time (RTO) and data loss (RPO).
4. A tabletop exercise annually that walks management through a ransomware scenario, including POPIA breach notification.

Each test should produce a short report. Those reports are valuable evidence for auditors, insurers and the board.

Load shedding has been suspended for well over a year, but grid instability remains a real planning risk. Backup infrastructure that loses power mid-job, or a server room without adequate UPS capacity, undermines the whole strategy. Make sure backup servers, storage and network equipment are on protected power, and that your DR site doesn't share the same single point of failure.

• Map where personal information lives - including in backups.
• Implement 3-2-1-1-0, with at least one immutable copy.
• Separate backup administration from your main domain credentials and enforce MFA.
• Back up Microsoft 365 independently of Microsoft's native retention.
• Host offsite copies in South African cloud regions where residency matters.
• Define RTO and RPO targets per system, agreed with the business.
• Test restores regularly and keep the reports.
• Align retention with POPIA: keep what you need, for as long as you need it, and no longer.

If you'd like an independent view of where you stand, our backup and disaster recovery team can review your current setup, and our data governance and POPIA service covers the wider compliance picture. Or simply book a free consultation.