If your business handles anything with a client’s name, ID number, banking details, or employee records on it — which is nearly every business — POPIA already applies to you. Most compliance conversations focus on cybersecurity, but a growing share of real enforcement action has come from ordinary operational failures, not sophisticated hacks. Physical document security, including how you dispose of printed paper, is part of that picture and it’s one of the easiest things to get right.
This is general information, not legal advice — for a formal compliance assessment, talk to a POPIA specialist.
Who actually enforces POPIA
POPIA isn’t policed by a government department in the way people expect. It’s enforced by the Information Regulator of South Africa, an independent statutory body created specifically under the Act. The Information Regulator handles POPIA complaints and enforcement directly; broader policy sits with the Department of Justice, and unresolved legal disputes go to the courts. In practice, the Information Regulator is the body you deal with if something goes wrong.
Enforcement is real, and it’s growing
A few recent, confirmed cases give a sense of how seriously this is now being taken:
- The Department of Justice was issued the Information Regulator’s first-ever administrative fine — R5 million — after failing to comply with a security enforcement notice following a 2021 cyberattack.
- Dis-Chem received an enforcement notice in 2023 after a third-party data breach exposed roughly 3.6 million people’s records, with the Regulator citing weak access controls and inadequate vendor oversight.
- Lancet Laboratories was fined after failing to notify affected people of a data breach within a reasonable time, as POPIA requires.
- Blouberg Municipality was hit with a court-confirmed R500,000 fine after personal information about a former employee was exposed.
The pattern across these cases isn’t exotic hacking — it’s unsecured processes: weak passwords, missed software updates, vendors without proper agreements, and slow breach notifications. Unsecured physical document handling is the same category of risk, just on paper instead of a server.
Your copier is a data processing system, not just a printer
This is the part most offices miss. A modern multifunction printer or copier scans, stores, and processes documents — often onto an internal hard drive — every time someone copies, scans, or prints something. That makes it a piece of infrastructure that touches personal information, not just office hardware. The same logic that applies to your laptops and servers applies to what happens on and around your copier: who can access it, what’s stored on it, and what happens to the paper that comes out of it.
Policies don’t destroy paper — workflows do
A written data protection policy is a good start, but it doesn’t shred anything by itself. What actually matters is the physical workflow, and it’s worth asking plainly:
- Where do printed invoices go once they’re no longer needed?
- Where are HR printouts and payslips disposed of?
- Who empties the office waste bins, and where does that paper end up?
If the honest answer is “into a normal bin,” that’s a gap worth closing — not because a shredder alone satisfies POPIA, but because “reasonable safeguards” for personal information realistically includes not leaving printed personal data for anyone to find.
What reasonable safeguards look like in practice
None of this needs to be complicated. The practical building blocks most offices are missing at least one of:
- Cross-cut (P-4) shredding for anything with personal or client information — the recommended minimum shredding security level for this kind of document.
- Locked waste and shredding bins, so paper isn’t sitting exposed between being discarded and being destroyed.
- Secure print release on shared printers and copiers, so printed documents with personal information don’t sit in an output tray for anyone to pick up.
- Hard drive overwrite settings on multifunction printers and copiers, so scanned/copied data doesn’t sit on the device indefinitely.
Where to start
You don’t need to overhaul everything at once. Start with the three questions above, confirm your shredder (if you have one) is actually rated for confidential documents, and check whether your office multifunction devices have any secure print or data-overwrite settings switched on.
Want a second pair of eyes on where your document workflow might be exposed? We’ll take a practical look and tell you straight where the gaps are.