Your customer database is probably well protected. The export of it that marketing pulled for a campaign in 2023 is probably not. It lives in a shared drive, three mailboxes and a laptop, and nobody has thought about it since the campaign ended. POPIA applies to every copy of personal information you hold, and the copies nobody remembers are the ones that leak.
Where shadow copies come from
- Exports: a spreadsheet pulled for a campaign, a report, a board pack, then never deleted.
- Mailboxes: client lists and ID documents sent as attachments, copied into every recipient’s mail store forever.
- Shared drives: the “temp” folder from a migration five years ago.
- Test systems: a copy of production data loaded into a development environment with weaker controls.
- Departed staff: whatever synced to personal devices before offboarding.
Why the Act cares
POPIA’s security and retention duties attach to the information, wherever it sits. A forgotten spreadsheet breached from a mailbox is a section 22 notification event exactly as if the main database had been hit. The retention rule cuts the same way: information may only be kept while a purpose exists, and a stale export has none. Every shadow copy is risk with no compensating value.
Finding and killing them
Search before you police. Most file platforms can scan shared storage for files containing ID numbers, phone numbers and email addresses in bulk, which surfaces the worst offenders in a day. Then change what creates them: limit who can export, prefer expiring links over attachments, refresh test systems from masked data instead of production copies, and put a recurring cleanup on the calendar so the sweep happens more than once. The goal is a world where the answer to “where is our customer data?” has one entry rather than forty.
Want to know how many copies of your client base exist right now? Tell us what’s on fire