Security Compliance in South Africa: What You Can't Ignore

Security companies in South Africa operate within several legal and regulatory frameworks. Two particularly relevant areas are PSiRA requirements for private security providers and POPIA requirements where personal information is processed. The precise obligations depend on the organisation, services, processing activities and circumstances involved.

This article provides general information for security operations and is not legal advice. Organisations should obtain appropriate professional advice for their specific obligations.

What does security compliance mean in South Africa?

Compliance is not a single product, document or checklist. For a security operation, it can involve the legitimacy and conduct of private security providers, the way personal information is processed, and the policies and procedures used to manage relevant responsibilities.

The Private Security Industry Regulation Act 56 of 2001 provides for regulation of the private security industry and establishes a regulatory authority. The Protection of Personal Information Act 4 of 2013, commonly called POPIA, regulates the processing of personal information and establishes conditions for lawful processing.

These areas can overlap in a security operation, but they address different questions. PSiRA concerns the private security industry and security service providers. POPIA concerns the processing of personal information by responsible parties. An organisation should assess which requirements apply to its own activities rather than assuming that one process covers every obligation.

PSiRA and private-security compliance

PSiRA is the regulator for the private security industry under the Private Security Industry Regulation Act. Its official consumer guidance states that consumers of security services should contract with security service providers registered with PSiRA and permitted to offer services within the industry.

PSiRA's consumer guidance also refers to the Code of Conduct for Security Service Providers, which contains binding rules for security service providers. This article does not attempt to summarise the registration, conduct or training requirements that may apply in a particular case. Those requirements should be checked against the current legislation, PSiRA material and appropriate professional advice.

Why checking a security provider's status matters

Before contracting for security services, a customer can make reasonable enquiries about the provider's legitimacy. PSiRA says consumers have a right to request proof of registration from a security service provider and may verify relevant registration information through PSiRA.

Depending on the services being considered, practical questions may include whether the provider is currently registered, whether deployed security officers are appropriately registered, and what current documentation the provider can make available. These checks are not a substitute for the customer's own procurement, contractual or legal review.

POPIA and personal information in security operations

POPIA can be relevant when a security operation processes personal information. The Information Regulator describes personal information as information relating to an identifiable natural or juristic person. Depending on the context, security operations may process identifying or contact details, visitor or access records, vehicle-related information, location information, images or video.

The fact that an operation uses technology does not determine whether processing is lawful. POPIA sets conditions for lawful processing, and the appropriate basis or justification depends on the specific processing activity. Consent is not the only consideration under POPIA.

The Act's minimality condition provides that personal information must be adequate, relevant and not excessive in relation to the purpose for which it is processed. A useful starting point is therefore to identify what information is processed, why it is needed, and whether the collection and use remain connected to that purpose.

Protecting personal information under POPIA

Section 19 of POPIA requires a responsible party to secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures. The Act refers to measures against risks such as loss, damage, unauthorised destruction, unlawful access to, or unlawful processing of personal information.

The Act does not reduce this requirement to one prescribed technology purchase. Organisations should consider the nature of the information they process, foreseeable risks, who can access it, how it is stored, and how safeguards are reviewed and maintained. The appropriate measures depend on the circumstances.

For security operations, practical questions can include: What personal information is held? Who needs access to it? What procedures govern collection, storage, sharing and retention? What happens if an unauthorised person accesses it? These are operational questions that should inform, not replace, legal and compliance advice.

Information Officers and internal responsibility

The Information Regulator states that Information Officers of public and private bodies are required to register with the Regulator under section 55 of POPIA, and that they may take up their duties only after registration. The Information Regulator describes responsibilities that include encouraging compliance with conditions for lawful processing, dealing with requests made to the body, working with the Regulator, and helping to ensure compliance with POPIA.

In practice, this makes information handling an organisational responsibility rather than a task that can be assigned solely to an IT system or an external supplier. Policies, internal awareness, access processes and oversight all need to reflect the organisation's own processing activities.

What happens when personal information is compromised?

POPIA contains notification requirements for security compromises. The Information Regulator's guidance states that, when a security compromise occurs, the responsible party must notify the Regulator and affected data subjects as soon as reasonably possible after discovering the compromise, subject to the circumstances described in the Act.

This is not a substitute for an incident-response plan or legal advice about a specific event. Security operations should ensure that relevant personnel know how to escalate a suspected compromise internally so that the responsible party can assess its obligations promptly.

Technology can support compliance, but it cannot guarantee it

Technology can support operational processes and recordkeeping, but purchasing technology does not automatically make an organisation POPIA-compliant, PSiRA-compliant or compliant with every other requirement that may apply.

For example, patrol-management tools can help a security operation structure patrol activity, record checkpoint interactions and review operational records. That may assist an organisation's own procedures, but it does not replace appropriate policies, training, access controls, governance or professional advice. Onguard's Patrol Management Software South Africa guide explains the operational roles of patrol verification, communications, rostering and reporting without presenting them as a compliance guarantee.

Practical compliance questions for security operators

The following questions are not an exhaustive compliance checklist, but they can help an organisation prepare for an informed discussion with its advisers and service providers:

• Is the relevant security provider registered with PSiRA?
• What personal information does the operation process, and why?
• Who can access that information, and what safeguards protect it?
• Is an Information Officer registered where required?
• Are staff aware of the organisation's information-handling procedures?
• Is there a process for escalating and responding to suspected security compromises?
• Are supplier claims about compliance being independently assessed?
• Are policies and procedures reviewed when systems, services or processing activities change?

For general discussion of security-operation technology and processes, or to discuss Onguard's current products, contact Onguard. For legal or regulatory obligations, obtain advice appropriate to your organisation and circumstances.