Email and POPIA basics for small offices

Why your inbox is really a database of personal information

When small business owners hear 'data protection', they often think of banks or hospital servers. Yet if you open the Sent Items or Downloads folder on the admin computer in a five-person South African office—whether a bookkeeping practice, a recruitment agency, an insurance broker, a law firm or a medical rooms—you will find hundreds of South African ID numbers, cell numbers, home addresses, bank confirmation letters, tax numbers and payslips.

Email is how small offices get work done: customers email ID copies to open an account, staff email payroll spreadsheets to the bookkeeper, and suppliers email banking details. Because nobody has time to file and delete every attachment, five years of email history on one desktop PC quietly becomes a complete archive of your customers' and employees' private lives.

What POPIA actually asks of a small business

Under the Protection of Personal Information Act 4 of 2013 (POPIA), any business that decides why and how personal information is processed is a 'responsible party'. There is no exemption based on headcount: a four-person office holding client ID numbers and banking details has the same core duty under Condition 7 (Security Safeguards, Section 19 of POPIA) as a large corporation.

However, Section 19 of POPIA does not demand that a small office buy enterprise banking hardware. Instead, it requires you to take 'appropriate, reasonable technical and organisational measures' to prevent loss of, damage to, or unauthorised access to personal information—by identifying foreseeable internal and external risks, putting reasonable safeguards in place, and checking that those safeguards are working.

Two other sections matter in everyday office life: Section 21 requires a written agreement with any 'operator' that processes personal information on your behalf (such as your cloud hosting, payroll or DNS security provider), and Section 22 requires you to notify the Information Regulator and affected people as soon as reasonably possible if there are reasonable grounds to believe their personal information has been accessed or acquired by an unauthorised person.

How small-office email breaches actually happen

In a small office, personal data rarely leaks because someone broke into a server room. It leaks in one of three everyday ways:

First, a staff member clicks a phishing link—often disguised as a SARS eFiling notice, a courier redelivery fee, a Microsoft 365 password expiry, or a shared invoice—and types in their email password. Once the attacker has the mailbox login, they can download years of attachments containing client ID numbers and bank details.

Second, someone opens a malicious attachment or installs a free utility (like a rogue PDF converter or browser extension) that includes an information stealer. The malware scans local folders for 13-digit SA ID numbers, payment card numbers and saved passwords, then sends them out over the internet—sometimes hidden inside DNS lookups that ordinary routers let straight through.

Third, a staff member accidentally emails a spreadsheet containing every client's ID number and cell number to the wrong recipient, or leaves an unencrypted laptop in a car.

Five reasonable safeguards any small office can put in place this week

1. Switch on two-factor authentication (2FA) on every email account. Even if a staff member is tricked into typing their password on a fake page, 2FA makes it much harder for an attacker to walk into the mailbox.

2. Stop keeping sensitive attachments in email forever. Move FICA documents, ID copies and payroll files into a password-protected folder with access limited to the people who need them, and empty the Downloads folder on shared admin PCs.

3. Check before you send or pay. Take ten seconds to verify recipient email addresses before sending spreadsheets, and always confirm new or changed supplier banking details with a phone call to a number you already trust.

4. Protect the office router with DNS filtering. Changing one setting on your office router to use a protective DNS service blocks known phishing and malware websites on Google Web Risk before they load, and checks outgoing DNS lookups for valid SA ID numbers and card numbers leaving the network.

5. Keep your paperwork tidy. Make sure your Information Officer is registered, keep a signed Section 21 Data Processing Agreement on file for your service providers, and keep your weekly security reports so you can show what measures you have in place if a client or insurer ever asks.