POPIA and remote IT support: a guide for MSPs

Why remote support is a POPIA issue

The Protection of Personal Information Act (POPIA) governs how personal information about identifiable people is processed in South Africa. Remote support tools give technicians access to devices full of exactly that: email, documents, customer lists, HR files. Even if a technician never opens a file, the access itself is part of how the data is protected, or not.

Responsible party or operator?

POPIA separates the responsible party, who decides why and how personal information is processed, from the operator, who processes it on the responsible party's behalf. When an MSP supports a client's systems, the client is normally the responsible party and the MSP is the operator.

That has two practical consequences:

• Section 20: an operator may only process personal information with the responsible party's knowledge or authorisation, and must treat it as confidential.
• Section 21: the responsible party must have a written contract with the operator requiring it to maintain appropriate security measures, and the operator must notify the responsible party immediately if it believes personal information has been accessed by an unauthorised person.

Security safeguards (section 19)

Section 19 requires appropriate, reasonable technical and organisational measures to prevent loss, damage and unauthorised access. For remote support, that translates into questions like:

• Does every technician sign in with MFA?
• Can a technician only reach the clients they are assigned to?
• Does the end user consent to attended sessions?
• Is every session and command logged with who, what, when and why?
• Can access be revoked immediately when someone leaves?
• Does any automation (including AI) receive only the data it needs?

Security compromises (section 22)

If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and, in most cases, the affected people, as soon as reasonably possible. As an operator, your job is to tell your client immediately. Good audit logs are what let you answer the first question everyone will ask: what was accessed?

A practical checklist for MSPs

1. Put a written operator agreement in place with every client.
2. Enforce MFA for all technician accounts.
3. Give technicians access per client, not to everything.
4. Tie remote sessions and scripts to a ticket or documented reason.
5. Keep an audit log and agree a retention period with each client.
6. Limit what automated tools and AI can see to metadata and telemetry where possible.
7. Have a written process for notifying clients of a suspected compromise.
8. Register your own Information Officer with the Information Regulator.

CitadelGate is being designed around these controls. See the security model for how.