Most POPIA work happens in software. But personal information lives on hardware, in rooms, behind doors. If someone can walk in, much of the rest doesn’t matter.
TL;DR: POPIA requires organisations to take reasonable technical and organisational measures to protect personal information, and physical access to the hardware that holds it is part of that. As of August 2026, South Africa’s Information Regulator had received more than 8,000 security compromise notifications, and it names inadequate security controls and human error among the main causes. Access control, surveillance and logged entry to server and comms rooms are compliance controls, not just facilities items.
When organisations talk about POPIA compliance, the conversation usually goes straight to firewalls, passwords, encryption and phishing training. All of that matters, and it belongs to your IT and security teams.
This article is about the other half.
Every record your organisation holds sits on physical hardware: a server, a storage array, a backup drive, a switch. That hardware sits in a room. The room has a door. And if the wrong person can get through that door, unplug a drive or plug something in, most of the controls in software are beside the point.
Why is security and compliance pressure rising in South Africa?
At its media briefing on 31 August 2026, the Information Regulator said it had received more than 8,000 security compromise notifications since POPIA’s enforcement provisions began. More than 1,220 of those arrived between April and the end of August 2026 alone — roughly 240 a month — and the Regulator expects more than 3,000 this financial year.
It also said the real number is likely higher, because some organisations don’t report at all.
Among the causes its assessments keep finding: inadequate security controls, and employee negligence or human error. Those are not purely digital problems. A door propped open, a contractor’s access card that was never deactivated and a comms cupboard with a shared key are all inadequate security controls.
The consequences are not theoretical either. The Regulator issues enforcement notices with deadlines to fix policies and put security measures in place, and failing to comply with one is an offence under POPIA that can carry an administrative fine of up to R10 million.
What does POPIA actually require for physical security?
POPIA doesn’t mention server rooms by name. What it does, in section 19, is require a responsible party to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures to prevent its loss, damage, unauthorised destruction, and unlawful access or processing.
It goes further. An organisation is expected to identify the foreseeable internal and external risks to the personal information it holds, put safeguards in place against them, check regularly that those safeguards are working, and update them as risks change.
Physical theft of hardware is a foreseeable risk. So is an unauthorised person in a comms room. So is a visitor left alone beside an open rack.
The Regulator has also made clear that there is no minimum threshold for reporting: a compromise must be reported whatever the perceived risk level. A stolen backup drive is a reportable event, whether or not anyone ever proves the data on it was accessed.
Why is physical security part of data protection?
Because the easiest way past a strong digital lock is often to walk around it.
The physical gaps we see most often are rarely dramatic:
- One person badges in, and two walk through.
- Access that outlives the reason for it. A contractor finishes a project in March and still has a working card in October.
- The comms cupboard in the corridor. Network equipment for a whole floor, behind a door that is locked with a key half the building has.
- The door propped for cooling. Usually a sign of a separate problem, and a security gap in its own right.
- Cameras that record but don’t help. Pointed at the wrong place, or with footage overwritten before anyone knew it was needed.
- No usable record. Nobody can say who was in the room last Tuesday afternoon.
- Each of these is a failure of a “reasonable organisational or technical measure”. None of them is fixed by software.
What does layered physical security look like?
Good physical security works in layers, so that no single failure exposes everything. Think of it as rings that get smaller and harder to cross the closer you get to the data:
- Site perimeter — fencing, gates, vehicle control and perimeter surveillance.
- Building entry — reception, visitor management and card or biometric access.
- Floor or zone — restricting who can reach the areas where critical rooms sit.
- The room itself — dedicated access control on server and comms rooms, ideally with a second factor, and cameras covering the door and the inside of the room.
- The rack or cage — locked cabinets, and in shared spaces, access control down to the individual rack.
- Across all five layers, the systems should record who went where and when, alert someone when a door is forced or held open, and keep footage long enough to be useful in an investigation.
Environmental monitoring belongs here too. Temperature, humidity, water and smoke detection protect the same hardware from a different kind of loss.
What will an auditor or the Regulator ask for?
When a security compromise happens, or an auditor reviews your controls, the questions are practical:
- Who has access to the server and comms rooms, and when was that list last reviewed?
- Can you produce an access log for a specific date and time?
- How are visitors and contractors signed in, escorted and signed out?
- How long is camera footage retained, and does it cover the door and the racks?
- When someone leaves, how quickly is their access removed?
POPIA also requires organisations to ensure that third parties processing personal information on their behalf maintain appropriate security measures. That makes the security of any colocation space, outsourced facility or contractor with access part of your own obligation.
If the honest answer to any of these is “we’d have to check”, that is the gap to close first.
Why does physical security matter more in November and December?
The end of the year is when the risk is highest and the tolerance for disruption is lowest.
Black Friday falls on 27 November this year. From then until the new year, retail, logistics and payments run at peak volume, and most organisations freeze changes to anything critical. Seasonal staff are issued temporary access. Contractors rush to finish fit-outs before the break. Then, from mid-December, many sites run with skeleton staff or none at all.
A security incident in that window is harder to detect, slower to respond to, and more expensive to recover from. The weeks you cannot afford to be down are the weeks to make sure the physical controls are working.
How should physical security be designed?
The strongest physical security is designed into the infrastructure, not bolted on afterwards.
Access control readers, cameras and sensors all need power, data and a route back to a central system. When the cabling, the room design and the security system are planned together, readers and cameras can be powered over the same structured cabling that serves the network, as we covered in last month’s article. Pathways are sized for them from the start, and everything reports into a single view rather than three separate systems nobody joins up.
When they are planned separately, by different suppliers, you tend to get cameras where the cable happened to reach, readers on the doors that were easy to wire, and gaps exactly where the systems meet.
Secure infrastructure is a compliance decision
Data protection is often treated as an IT project and physical security as a facilities line item. POPIA doesn’t make that distinction. It asks whether your measures, taken together, are reasonable.
The server room door is one of them.
If you want to know how your server rooms, comms rooms and data centre spaces would stand up to that question, we can help. With more than 40 years in mission-critical infrastructure, we offer a comprehensive infrastructure assessment that covers physical access, surveillance and monitoring alongside power, cooling and cabling, so you know where the gaps are before an auditor or an incident finds them. Contact us to arrange one.
Frequently asked questions
Does POPIA require physical security?
POPIA requires organisations to take appropriate, reasonable technical and organisational measures to prevent the loss of, damage to, or unlawful access to personal information. It doesn’t list specific physical controls, but physical access to the hardware that stores personal information is a foreseeable risk that those measures need to address.
Is a stolen server or hard drive a reportable security compromise?
Generally, yes. The Information Regulator treats any loss of, or unauthorised access to, personal information as a security compromise, and has said there is no minimum risk threshold for reporting. A compromise does not need to be confirmed before it is reported.
How many security compromises are reported in South Africa?
As of 31 August 2026, the Information Regulator had received more than 8,000 notifications in total, including more than 1,220 between April and August 2026. It expects more than 3,000 in the 2026/27 financial year, and believes some compromises go unreported.
What is the maximum POPIA fine?
An administrative fine of up to R10 million can be imposed for certain offences under POPIA, including failing to comply with an enforcement notice from the Information Regulator.
What is layered physical security?
A set of controls arranged in rings — site perimeter, building entry, floor or zone, the room, and the rack or cage — so that no single failure exposes the hardware that holds your data.
Who is responsible for security in a colocation facility?
The colocation provider is responsible for the facility, but under POPIA you remain responsible for ensuring that anyone processing personal information on your behalf maintains appropriate security measures. Ask your provider for access logs, visitor procedures and camera coverage of your space.
What does an infrastructure assessment cover?
It reviews the physical environment of your server rooms, comms rooms and data centre spaces, including access control, surveillance and monitoring, alongside power, cooling and cabling, and identifies the gaps to close first.
Sources
- InfoReg concerned by alarming rate of data breaches – ITWeb, 31 August 2026
- Information Regulator ramps up enforcement – Michalsons, September 2026
- Fact Sheet on Handling of Security Compromises – Information Regulator, August 2025
- Protection of Personal Information Act 4 of 2013, sections 19, 21 and 109
- Your 2027 Cabling Plans Need to Start in 2026 – Advanced Infrastructure, October 2026
