§ Experia Systems · Journal
Notes from the practice.
Case studies, engineering notes, and the occasional opinion. Written by the people who run the systems.
-
Notifying 380,000 people after a supplier breach
A breach at compliance supplier RelyComply left three of our clients with about 380,000 people to notify. How the notices went out within five business days, and what POPIA required.
-
How long could you run on paper?
Only 40% of South African organisations recover from ransomware within a week. How to work out how long yours could run without its systems, and what to prepare.
-
What the Information Regulator has fined so far
The Information Regulator has issued six POPIA fines, from R100,000 to R5 million. Most followed an ignored enforcement notice. What each fine was for.
-
Seven questions for any supplier that holds your client data
A supplier that holds your client data can put your name on a breach notice. Seven questions to ask before you sign, and again every year.
-
Your supplier was breached: what you owe your clients
When a supplier is breached, POPIA still expects you to notify the Regulator and your clients. What you owe each of them, and the order to do it in.
-
A data breach starts the section 22 clock
Section 22 requires notice to the Regulator and affected people as soon as reasonably possible. Decide the owner, templates and channels before the incident.
-
What happens to personal information when a supplier leaves
POPIA keeps you accountable for data a former supplier still holds. Return it, instruct deletion in writing, get proof, and revoke every access.
-
The spreadsheet nobody remembers
POPIA applies to every copy of personal information, including the exports, attachments and test databases nobody remembers.
-
One marketing list, two sets of rules
POPIA governs how contacts join your marketing list. The CPA’s 2026 opt-out registry governs when you must stop. One list has to satisfy both.
-
A consent record you can produce in an afternoon
POPIA puts the burden of proving consent on the business. What a defensible consent log records, and the afternoon test for your marketing list.