A supplier that serves many companies is an attractive target, because one break-in yields the client data of every company it serves. That happened in South Africa in September 2026, when a breach at one identity-verification supplier led several financial services firms to warn their own clients.
Under POPIA you stay answerable for client data a supplier holds for you. These seven questions take one meeting. Ask them before you sign, and again every year.
The seven questions
- Exactly which client data do you hold, and for how long? A supplier that keeps every record forever turns one break-in into years of exposure. Look for a set period, followed by deletion.
- Who else receives it? Most suppliers rely on their own suppliers, such as a hosting company or a support desk. Ask for the list.
- How do your staff sign in to the systems that hold it? The answer should include a second step beyond the password, such as a code from a phone app. Stolen passwords are among the most common ways in.
- Is the data encrypted where it is stored and while it moves? Encryption scrambles the data so that a stolen copy is unreadable without the key.
- When did an outside firm last test your security? Ask for the date and a summary of the findings. A supplier that has never been tested does not know its own weaknesses.
- How fast will you tell us about a suspected breach, and who makes the call? POPIA requires the supplier to tell you immediately. Get a named person and a phone number.
- What happens to our data when the contract ends? The answer should be return or deletion, confirmed in writing.
How to read the answers
A good supplier answers all seven without checking, because its other clients have asked the same things. A vague answer is itself a finding. “We take security very seriously” answers none of the seven.
Start with the suppliers that hold the most sensitive data: identity documents, bank details, health records. Those are the records that put your name on a breach notice.
Put the answers in the contract
Answers given in a meeting change when staff change. POPIA requires a written contract with every supplier that handles personal information for you, so write the answers into it: the retention period, the list of other parties, the breach notice, and the deletion at the end. Then the answers hold even after the people who gave them have moved on.
Which of your suppliers could answer all seven today? Tell us what’s on fire