If your business stores South Africans' personal information, the Protection of Personal Information Act (POPIA) applies to you — and that includes the copies of that information sitting in your backups. Backups are easy to forget in a compliance review, yet they are personal information like any other. This article looks at what POPIA means for your backup strategy, and where storing data inside South Africa helps.
This is general information, not legal advice — for decisions about your specific obligations, consult your legal advisor or information officer.
POPIA in one paragraph
POPIA regulates how personal information is collected, processed, stored and destroyed. The party deciding why and how data is processed (the responsible party — your business) must ensure appropriate, reasonable technical and organisational safeguards, and remains accountable even when processing is outsourced to an operator such as a cloud storage provider. Failures can bring enforcement action, fines and reputational damage — but more practically, POPIA's requirements are simply a decent baseline for handling customer data with care.
Why backups are a POPIA issue
- Backups are personal information. A customer database in a backup archive is still a customer database. Safeguard obligations follow the data into every copy.
- Security safeguards (Section 19). You must secure the integrity and confidentiality of personal information against loss, damage, unauthorised destruction and unlawful access. Off-site, encrypted, access-controlled backups are one of the clearest ways to demonstrate this — losing data to ransomware with no recoverable backup is itself a Section 19 conversation.
- Cross-border transfers (Section 72). Sending personal information outside South Africa is only lawful under specific conditions — adequate protection in the destination country, consent, contractual necessity and so on. Every offshore backup destination adds a compliance question you must be able to answer.
- Retention and destruction. Personal information may not be kept longer than necessary. Backup rotation and lifecycle policies are how that principle reaches your archives.
- Breach notification (Section 22). After a security compromise you must notify the Regulator and affected individuals. Reliable backups shorten incidents and support honest, specific notification.
Where data residency helps
Keeping backups on Z1 Storage means the data stays in South African data centres. That does not make you "POPIA compliant" by itself — compliance is a property of your whole process — but it removes an entire category of work:
- No Section 72 analysis for your backup destination: the data never leaves the country.
- One legal regime. No mapping of foreign privacy laws, adequacy assessments or extra contract clauses for the storage leg.
- Straight answers for customers and auditors. "Where is our data?" — "In South Africa." Questionnaires get shorter.
- Practical benefits come along free: low latency and full-line transfer speeds to local networks make backup windows and restores faster.
A POPIA-aware backup checklist
- Know where every copy lives — including backup destinations, replicas and old archives.
- Encrypt — in transit (HTTPS/TLS) and ideally client-side before upload, as supported by tools like Duplicati, Hyper Backup and HBS 3.
- Control access — dedicated access keys per system, limited to the buckets they need.
- Set retention deliberately — align backup rotation and bucket lifecycle rules with your retention schedule, so data is destroyed when it should be.
- Protect against tampering — Object Lock immutability keeps restore points intact even if credentials are compromised.
- Test restores — a backup you cannot restore protects nobody's information.
- Document it — your information officer should be able to describe the backup flow, destinations and safeguards in one page.
The bottom line
POPIA does not demand that your data never leaves South Africa — but keeping it here makes the compliance story shorter, the risk surface smaller and the performance better. Z1 Storage gives you POPIA-friendly, S3-compatible backup space hosted in South Africa at a flat R0.30/GB/month. Sign up — your first 10GB is free.