CDComplianceDesk
← All templatesStart free trial

Privacy and data

Information Security Policy

A practical information security policy that sets out how your business protects information: access control, passwords, encryption, backups, devices, suppliers, incidents and training, in support of POPIA section 19.

Starting point, not legal advice. It is general information and not legal advice. Have it reviewed by a South African attorney before you rely on it. Status: compiled from public sources, not reviewed by a lawyer. Wording last checked 2026-10-31.

1. Fill in your details

2. Download

5 fields still empty. They show highlighted in the document so you can finish them in Word.

Sign up free to download

Already have an account? Log in.

Preview

Information Security Policy

[Organisation name] ("we") adopts this policy from [Effective date]. It sets out how we protect the confidentiality, integrity and availability of information, including personal information, as the Protection of Personal Information Act requires. The policy owner is [Policy owner (role)]. It is reviewed at least once a year.

1. Scope

This policy applies to everyone who works for us and to all information we hold, on paper, on devices and in the cloud.

2. Classifying information

  • Confidential: personal information, financial and client data, passwords and contracts. Share only with people who need it.
  • Internal: everyday business information, not for outsiders.
  • Public: information we publish on purpose.

3. Access control

  • People get the access they need for their role and no more. Access is removed when someone leaves or changes role.
  • Each person has their own account. Strong, unique passwords and multi-factor authentication are required for email, admin and cloud systems.
  • Admin accounts are limited and reviewed regularly.

4. Devices and networks

  • Devices have screen locks, disk encryption, antivirus or equivalent, and a firewall where applicable.
  • Critical security updates are applied within 14 days of release.
  • Public or unsecured wireless networks are not used for confidential work without a VPN.

5. Data protection and backups

Confidential information is encrypted in transit and, where practical, at rest. Backups: [Backup arrangement]. Paper records are locked away, and disposed of securely when they are no longer needed.

6. Suppliers and operators

Suppliers that handle personal information sign an operator agreement and are reviewed once a year.

7. Incidents and breaches

Anyone who suspects a security incident, lost device or data leak must report it at once to [Who incidents are reported to]. We contain it, investigate, and follow our data breach response plan, including notifying the Information Regulator and affected people where POPIA section 22 requires.

8. Training and awareness

We train staff on joining and at least once a year, and run reminders about phishing and safe handling of personal information.

9. Monitoring and review

We review access, logs, risks and this policy at least once a year, and after any incident.

When to use it

  • You need documented security measures for POPIA section 19 and your PAIA manual
  • A client or tender asks for your information security policy
  • You are formalising how you handle backups, access and suppliers

Before you use it

  • Write only what you actually do, or will do by a set date. A policy that is not followed is worse than none
  • Adjust the controls to the size and risk of your business. A small business can keep it to one page of rules
  • Name real people in the roles, and test your backups and your breach plan
  • Pair it with your breach response plan, acceptable use policy and operator agreements
  • Have a security professional review it before first use

Related laws and frameworks

POPIACYBERCRIMES ACTECTA

Sources

Keep this policy current and acknowledged

Store it in ComplianceDesk, track versions and collect staff acknowledgements.

Start free trial