Assign responsible-party and operator roles
The Information Regulator explains Information Officer duties and guidance for special personal information and children's information. Confirm the responsible party, relevant operator relationship and information involved before selecting controls. A generic personal-data label should not obscure category-specific handling considerations.
Sources: [1]
Map the copies used in ordinary work
Choose a process such as employee administration or customer onboarding. Identify the approved record, access groups and any provider transfer. Review exports, attachments and support work areas with the process owner.
Use safe examples to test classification and handling decisions. Ask whether an unapproved destination is detected and whether a legitimate recipient can still complete the authorised task. Record any unsupported path as a coverage limitation.
Prepare the Section 22 reporting handoff
The regulator describes Section 22 notifications where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. The responsible party must assess the applicable notification duties. The regulator's current process uses its eServices portal; operators should promptly escalate concerns to the responsible party.
Retain enough context for an accountable decision
Record what happened, which information was involved, who assessed it and what containment occurred. Restrict evidence access and agree what the operator must provide. Retest the originating workflow after remediation, and keep the assessment rationale even when a technical alert does not establish a reportable compromise.
Practical checklist
- Map responsible-party, operator and Information Officer responsibilities.
- Review special personal information and children's information separately.
- Prepare the current eServices reporting route and escalation contacts.
- Test evidence access, approved transfers and remediation.
Applying this with TRIAS
Evaluate TRIAS discovery and supported DLP channels against the approved information flows. Confirm that operator and responsible-party teams can review findings without unnecessary disclosure. The organisation retains responsibility for POPIA applicability and security-compromise notification decisions.
Official sources
Last checked: . Practical examples are editorial implementation suggestions. Applicability depends on your organisation and jurisdiction.