When a laptop is stolen, a backup tape goes missing or an attacker copies a database, the question that decides the damage is simple: was the data encrypted, and were the keys kept somewhere else? Many organisations encrypt some data, in some places, with keys stored next to the data they protect, which gives far less protection than the word "encrypted" suggests.
Encryption is one of the few controls that still protects information after other defences have failed. Done properly, it is also central to meeting South Africa's data protection obligations.
Why does POPIA make encryption a business issue?
The Protection of Personal Information Act (POPIA) requires every responsible party to secure the integrity and confidentiality of personal information in its possession or under its control. Section 19 requires appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of it.
To meet that duty, an organisation must identify foreseeable risks to the personal information it holds, establish safeguards against them, verify that the safeguards work, and update them as risks change. The Act also requires the organisation to have due regard to generally accepted information security practices.
Encryption is not named as the only acceptable measure, but it is one of the most widely accepted. It also matters after an incident. Under section 22, where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, the organisation must notify the Information Regulator and affected individuals. Strong encryption with well-protected keys is a significant factor when assessing what an attacker could actually read.
Where should data be encrypted?
Data needs protection in each state it passes through.
| State | Examples | Typical controls |
|---|---|---|
| At rest | Databases, file shares, laptops, backups, cloud storage | Disk, database and file-level encryption |
| In transit | Web traffic, APIs, email, links between offices and to the cloud | Transport encryption, VPNs, encrypted email |
| In use | Data being processed by applications | Access control, application-level encryption of sensitive fields |
Start with an inventory. You cannot encrypt what you have not found, and personal information tends to spread into spreadsheets, test environments, log files and exports that nobody has catalogued. Prioritise by sensitivity: identity numbers, financial details, health information and credentials first.
Pay particular attention to backups and test systems. Production databases are often well protected while copies used for testing or recovery sit unencrypted with wide access.
Why is key management the hard part?
Encryption algorithms are rarely the weak point. Keys are. An encrypted database is only as secure as the key that unlocks it, and a key stored in a configuration file on the same server offers little real protection.
Sound key management covers the full key lifecycle:
- Generation using approved, strong methods.
- Storage separate from the data, ideally in a hardware security module or a dedicated key management service.
- Access control so that only named systems and people can use each key, with every use logged.
- Rotation on a defined schedule and immediately after any suspected compromise.
- Backup and recovery so that losing a key does not mean losing the data.
- Retirement and destruction when data or systems are decommissioned.
Separation of duties matters here. The administrators who manage a database should not also control the keys that protect it.
How do PKI and digital signatures fit in?
Encryption protects confidentiality. Public key infrastructure (PKI) and digital signatures protect identity and integrity.
PKI issues and manages the digital certificates that let systems prove who they are, which underpins encrypted web traffic, secure email, device authentication and VPN access. A poorly run PKI causes outages when certificates expire unnoticed, and security gaps when certificates are issued without proper checks.
Digital signatures prove that a document, transaction or piece of software came from a known party and has not been altered. They support electronic approvals, contract signing and software integrity, and they create an audit trail that is far harder to dispute than an email confirmation.
What MITS Institute does about it
MITS Institute helps organisations design and implement encryption, key management, PKI and digital signature controls that fit their risk and regulatory obligations. We map where personal information lives, assess current safeguards against POPIA section 19, define an encryption and key management standard, and plan the work to close the gaps. Our compliance consulting practice connects these technical controls to the policies, evidence and reporting your Information Officer needs, and our cyber solutions cover the identity, authentication and monitoring controls that sit alongside encryption.