Holding personal information you no longer need is the most common and most avoidable breach of South Africa’s data protection law. The Protection of Personal Information Act requires that you keep only what you actually need, for only as long as you need it, and that you protect what you hold. Most small businesses fail the first two without ever being attacked.
The information covered is broader than owners expect: contact details, place of work, financial information, physical address and medical history all qualify, which means almost every business processes personal information.
Deleting data is a compliance activity
Old customer lists, former employees’ records, spreadsheets exported years ago and inboxes holding identity documents are all liabilities. Every record you no longer need is risk you are carrying for no benefit. Setting retention periods and actually deleting to them is the cheapest compliance work available and almost nobody does it.
The penalties are not theoretical
Non-compliance exposes a business, and in some circumstances the person responsible for compliance, to administrative fines and criminal sanction including imprisonment. That is unusually severe for a commercial statute, and it is why appointing someone accountable and documenting what you decided matters.
Breaches are mostly not sophisticated attacks
The records exposed each year come overwhelmingly from human error, weak credentials and misconfigured systems rather than targeted hacking. That is encouraging for a small business, because the fixes, access control, multi-factor authentication, training people not to send identity documents by email, are affordable and within reach.
Compliance is a trust argument with customers
Beyond the legal obligation, being able to tell customers what you hold, why, and for how long is a competitive position in categories where people are asked for sensitive information. Treating it as a trust exercise rather than a paperwork exercise produces better answers and a better business.
Know who enforces it and what they require
The Act is enforced by the Information Regulator, which publishes the registration, reporting and breach notification requirements. A business that has read those directly is considerably better prepared than one relying on consultants’ summaries.
Frequently asked questions
What counts as personal information?
Contact details, place of work, financial information, physical address and medical history among others, which means almost every business processes it.
What is the most common failure?
Holding information longer than necessary. Old customer lists, former employee records and inboxes containing identity documents are risk carried for no benefit.
How serious are the penalties?
Administrative fines and, in some circumstances, criminal sanction including imprisonment for the person responsible, which is unusually severe for a commercial statute.
Do breaches come from sophisticated attacks?
Mostly not. Human error, weak credentials and misconfigured systems account for the majority, which means affordable fixes address most of the risk.
Is there a commercial benefit to compliance?
Yes. Being able to tell customers exactly what you hold, why and for how long is a trust advantage in any category handling sensitive information.
Further reading
Originally published in April 2017. Updated September 2026 to focus on the retention and protection obligations a small business must meet, in place of a conference preview.
