Your business has Backups.

Woohoo.

Somewhere, a green tick is glowing on a dashboard, and the IT guy feels safe in his job. So, it sits in isolation, promising untold riches when needed, tucked away out of sight and definitely out of mind. But when did anyone last check whether those backups actually work? Who can access them? And if they contain customer or employee information, are they protected properly?

“We back everything up” sounds reassuring. It is also not, on its own, a POPIA compliance plan.

Wait; we talking about POPIA or Backup? Well, they’re kind of linked:

Let’s clear up the misconception: POPIA isn’t the big bad wolf regulating your every move.

It doesn’t prescribe a set product, schedule, or number of copies. It doesn’t say your backups need backups, which are to be stored in Fort Knox. It definitely does not send qualified meteorologists to ensure your Cloud is Cloudy enough. What it does require is a responsible party to take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access and unlawful processing.

What does this mean, in simple English? A business is required to identify foreseeable risks and have sufficient safeguards to ensure that work correctly. So, whilst backups can be an important part of your security/recovery plan, their existence doesn’t automatically make your business compliant.

The real question is whether your safeguards meet the minimum threshold for the sensitivity of information your business has access to.

Why is this relevant? Because Backups contain personal info:

A backup is still a copy of the data. If it contains names, ID numbers, contact details, payroll records or customer information, it needs to be protected like the original.

That means thinking about who can access it, how it is secured, where it is stored and how long it is kept. An old backup sitting in an account nobody remembers is not harmless just because it has a date from three years ago.

And if a backup is exposed, stolen or accessed without permission, you may have a security compromise to deal with. POPIA’s notification requirements can apply. “It was only the backup” is unlikely to be a satisfying explanation to the people whose information was in it.

Confused? Here’s your five question checklist:

  1. Do they run reliably? Know what is backed up, how often it happens and whether failures trigger an alert someone actually sees.
  2. Can you restore the data? Test recovery. A backup that has never been restored is a promise, not proof.
  3. Who can get in? Limit access to the people who need it, and protect accounts with strong authentication. Review access when people change roles or leave.
  4. Are the copies protected? Use suitable security controls, such as encryption and separation from your everyday systems, based on the sensitivity of the information and the risks involved.
  5. Do you know when to delete them? Set retention rules. Keeping personal information forever “just in case” creates more data to protect and more to explain later.

Is this still relevant if your Backups are a Cloud Operators Problem?

If a service provider processes personal information for your business, POPIA’s operator rules matter. The responsible party must have a written contract requiring the operator to maintain the required security measures. The operator must tell the responsible party immediately if it has reasonable grounds to believe personal information was accessed or acquired by an unauthorised person.

So read the provider agreement. Understand what is stored, who can access it, how incidents are reported and what happens to the data when the service ends. “It’s in the cloud” is a location description, not a security strategy.

Bottom line: Make Backups part of your plan:

Good backups help a business recover from hardware failure, accidental deletion, ransomware and other disruptions. POPIA compliance means treating those copies as personal information that needs sensible protection, regular checks and a clear retention plan.

Start with a simple test: pick one important system and ask your team to restore it. If nobody knows how, or the answer involves finding someone who left last winter, you have useful work to do.

Vox can help your business explore secure, resilient technology solutions that support continuity and keep your people connected. Because a backup should be ready when you need it, not merely available to look confident in a dashboard.