POPIA for accounting firms holding client data
What POPIA asks of a South African accounting firm holding client payroll, tax and ID records: responsible party duties, safeguards, officers, breaches.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa
Think about what sits in an ordinary accounting practice on an ordinary Tuesday. Copies of directors' identity documents for a CIPC filing. A payroll client's salary schedule with every employee's bank account. A sole trader's medical aid certificate attached to a tax return. Bank statements for several businesses, waiting to be processed.
Very little of that is the firm's own information, yet the firm decides how it is collected, where it goes and who sees it. Under the Protection of Personal Information Act, that makes the firm accountable for it. This article sets out the duties that matter most for a practice and the controls that make them workable.
Your firm is a responsible party
The Information Regulator says any organisation, public or private and irrespective of its size, or any individual that processes personal information is a responsible party with a duty to comply with POPIA's eight conditions for lawful processing.
There is no small-practice exemption in that sentence. A small firm that runs payroll for a handful of clients holds employee names, identity numbers, tax numbers, salaries and bank details for people it has never met. Those employees are data subjects, and the firm's handling of their information is subject to the same conditions as a bank's.
A practical first step is a short register of the personal information the firm handles by service line:
| Service | Typical personal information | Who in the firm sees it |
|---|---|---|
| Payroll | IDs, tax numbers, salaries, bank details | Payroll staff, reviewing manager |
| Tax returns | Income, medical, retirement and family details | Tax staff, signing practitioner |
| Company secretarial | Directors' and owners' IDs and addresses | Secretarial staff |
| Statements and audit | Debtors, creditors, payroll reports | Engagement team |
The register shows where the sensitive material concentrates, and therefore where the safeguards need to be strongest.
Registering the information officer
The Regulator says public and private bodies must register their Information Officers with it, as section 55 of POPIA requires, and that Information Officers may only take up their duties once registered. The Act as published on the government's site says the same in section 55(2). Registration is done on the Regulator's eServices Portal.
For most firms the information officer is the managing partner or sole practitioner unless the role is formally passed on. Check that the registration exists and is current, and that staff know who the officer is. When something goes wrong, they need to know whom to tell within minutes, not after a search through old e-mails.
Safeguards for client files
The POPIA text published on the government's page requires a responsible party to secure personal information with appropriate, reasonable technical and organisational measures. That includes identifying foreseeable risks, maintaining safeguards against them and regularly verifying and updating those safeguards.
In a practice, the foreseeable risks are rarely exotic. They look like this:
- a payroll file e-mailed as an attachment to the wrong client contact;
- a former employee who still has access to the shared folders;
- a junior on the audit team opening a client the firm had agreed to keep within a small group;
- a link to a document that still works months after the matter closed.
"Regularly verifying" is the part most firms skip. Put a date in the diary, at least once a year, to review who can open what, which links are still live and whether leavers' access was removed.
How Achekam helps with access and sharing
Several of Achekam's controls map onto those risks directly.
Restricting a client to named staff. Partners and administrators can restrict a client, or a single engagement, to named people and record the reason. A restriction is lifted rather than deleted, and who did what and when is recorded. The account manager and the engagement's partner and manager can always open it, so plan the restriction with that in mind.
Sharing a document without sending it. Staff can share a vault document with a named person through an e-mailed link that can block downloading, require a code and be revoked. Every view and download is recorded. Links last seven days by default, which suits a client who needs to look at a draft rather than keep it.
A record of changes. Record Governance keeps a log of changes to governed records showing who did what, when and with what result, and the log can be filtered and checked for an unbroken chain. It covers records under record governance, not every screen, and viewing it needs a specific permission, so decide in advance who in the firm holds that permission.
None of this makes a firm's processing lawful on its own. The firm still decides what to collect, how long to keep it and who should see it.
When information gets out
The POPIA text published on the government's page requires a responsible party that has reasonable grounds to believe personal information was accessed or acquired by an unauthorised person to notify the Information Regulator and the data subject as soon as reasonably possible. The notice to the data subject must be in writing, for example by post or e-mail, or in another way the Act allows.
For a firm, that means having the steps written down before they are needed:
- Whoever spots the problem tells the information officer the same day.
- The officer establishes what was exposed, whose information it was and to whom.
- Access is cut: links revoked, passwords changed, the wrong recipient asked to delete.
- The officer decides on notification and records the reasons either way.
- The client is told, because their employees or customers may be the data subjects.
Payroll data deserves particular care here; keeping bureau salary data confidential looks at that work in more detail, and using AI on client documents under POPIA covers what changes when documents are read by AI tools.
A first hour with the Regulator's page
Start by reading the Information Regulator's POPIA page, which explains how information officers are registered, what their duties are and where the guidance notes and forms are kept. Then check your firm's registration, draw up the register of personal information by service line, and book the first access review.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
