At a media briefing on 31 August 2026, the Information Regulator disclosed that it has received more than 8 000 security compromise notifications since the enforcement provisions of the Protection of Personal Information Act took effect, including over 1 220 in the financial year that began on 1 April 2026, with roughly 3 000 projected by year end. The causes it identified were not exotic. Inadequate security controls, employee negligence, weak passwords and ransomware accounted for the bulk of them, and the public sector drew particular criticism for underinvestment.

Against that backdrop, remote and hybrid working has quietly changed where personal information actually travels. A municipal official reviewing case files from a home fibre line, an attorney opening a client matter on conference Wi-Fi in Sandton, a researcher pulling records over a mobile hotspot in Gqeberha, all of them are moving information across networks that their organisation neither owns nor monitors. Section 19 of POPIA requires a responsible party to secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures, with regard to generally accepted information security practices. It does not tell you which measures. That silence is deliberate, and it is where the practical questions live.

At the level of an individual practitioner, one of the available measures is trivially easy to adopt: you can grab ExpressVPN from their official site, install it on a laptop and a phone in a few minutes, and from that point the traffic between those devices and the provider's server is encrypted. Whether that amounts to a meaningful safeguard, and whether it does anything at all for an organisation's compliance position, is a considerably longer conversation.

What the encrypted channel covers

A consumer VPN establishes an encrypted connection between a device and a server operated by the provider. Traffic leaving the device travels inside that channel, so the network in between, whether a hotel router, a shared office line or a mobile network, sees an unreadable stream rather than a legible sequence of requests. Name resolution runs through the provider rather than the local network, which closes a common and underappreciated leak. The local operator learns that a device is connected to a server somewhere and very little else.

For information in transit across networks the responsible party does not control, that is a genuine reduction in exposure. It addresses a narrow risk properly, which is more than can be said for a good deal of security spending.

Where the argument stops

The channel protects the path. It does nothing about anything at either end.

It does not authenticate the person using the device, so a shared laptop with a saved password remains a shared laptop with a saved password. It does not detect a phishing email, and phishing is the entry point behind a large share of the compromises that eventually get notified to the Regulator. It has no bearing on excessive collection, on retention beyond purpose, on the absence of an operator agreement, or on any of the other conditions for lawful processing that enforcement notices have repeatedly turned on. The Regulator's action against the South African Bureau of Standards is instructive here: as set out in a recent legal brief published on Polity, the enforcement notice did not follow simply because SABS suffered a ransomware attack in 2024, but because an own-initiated assessment found underlying compliance failures across several POPIA conditions.

The lesson generalises. Encryption in transit is one line in a section 19 assessment, not a substitute for having done the assessment.

An individual tool and an organisational control are different things

There is a persistent conflation between a personal VPN subscription and the remote access infrastructure an organisation deploys, and the two carry almost opposite risk profiles.

A personal subscription routes an individual's traffic through a commercial provider. An enterprise remote access VPN, by contrast, creates a doorway into the internal network. The NSA and CISA have made the point bluntly in their joint guidance on selecting and hardening remote access VPN solutions, noting that because these servers are entry points into protected networks, they are themselves prized targets, and that state-sponsored actors have repeatedly exploited known vulnerabilities in them. Their recommendations run to standards-based products, multi-factor authentication, rapid patching and tight restriction of the management interface.

An organisation that adopts a consumer product as its remote access answer has not built the second thing. It has distributed the first thing, which introduces a third party into the network path and raises its own due diligence questions about that provider's logging practices, jurisdiction and audit history. Those questions deserve answers before anyone records the measure in a compliance register.

Questions worth asking before treating it as a safeguard

For information officers and legal advisers, a handful of questions separate a defensible control from a purchased reassurance:

• What specific risk in your risk assessment does this address, and is that risk material to the categories of personal information your organisation actually processes?
• Does the provider retain connection logs, and where is it incorporated? A provider that logs undermines the reason for introducing it.
• Is the tool enforced, or optional? A measure that staff can silently switch off is not a measure the organisation can rely on when the Regulator asks what safeguards were in place.
• Does it cover the devices where the exposure sits, including personal phones used for work email under a bring-your-own-device arrangement?
• Have you verified that it is working, as section 19 requires safeguards to be regularly verified rather than merely installed?

None of those questions is answered by a procurement decision. They are answered by documentation, which is what the Regulator asks for.

Proportionality, not procurement

The Information Regulator has signalled that the compliance environment is tightening. It has proposed amendments moving towards immediate fines on a finding of non-compliance, closer to the GDPR model, rather than the current approach that allows a responsible party to escape a fine by complying within a grace period. It has also begun writing to responsible parties to require proof of compliance rather than waiting for complaints to arrive. Its own characterisation of the prevailing attitude, that organisations treat data protection as a box to tick, is the more damning finding.

Read in that light, encrypting traffic on untrusted networks is a sensible and inexpensive precaution for anyone who handles other people's personal information away from a controlled environment. For an individual attorney, consultant or researcher, it is worth doing. For an organisation, it belongs in a risk assessment alongside multi-factor authentication, device encryption, patching discipline, access control and staff training, none of which it replaces and any one of which will matter more in a given incident.

The measure that fails an assessment is rarely the one that was absent. It is usually the one that was present, unverified, and quietly assumed to be doing more work than it was.