CRM POPIA Compliance: Security Duties for SA Businesses

CRM POPIA compliance means that the business running the CRM stays accountable under POPIA for every contact record in it: it must bind the software vendor by written contract, secure the data, decide where the data lives and how long it stays, and report a compromise. The CRM software buying guide covers choosing a system; this post covers what the Protection of Personal Information Act (POPIA) expects once customer data is inside it.

A CRM is usually the largest concentration of personal information a small business holds: names, mobile numbers, email addresses, deal notes, and often synced email and WhatsApp history. That makes it the first place a regulator, a customer or an attacker would look. The sections below take the relevant parts of the Act one at a time and turn each into a setting you can check and a record you can keep. This is a practical reading of the Act, not legal advice.

CRM POPIA Compliance: Who Is Legally Responsible for the Data?

Under POPIA the business that decides why and how personal information is processed is the responsible party, and a CRM vendor that stores or processes that information on its behalf is an operator. Buying a well-known platform does not move the responsibility. The Act's duties attach to you, and the vendor's obligations come through the contract between you.

Section 20 sets the operator's baseline: it must process information only with the knowledge or authorisation of the responsible party and treat what comes to its knowledge as confidential (section 20 of POPIA). That protects you in one direction only. Whether your own staff export the database to a personal laptop is entirely your side of the line.

Responsibility also needs a named person. Section 55(2) says information officers take up their duties only after the responsible party has registered them with the Regulator (section 55 of POPIA). Whoever holds that role should understand the CRM first, because it is where most of the personal information sits.

What Security Safeguards Does the Act Require of a Customer Database?

The Act requires "appropriate, reasonable technical and organisational measures" to prevent loss, damage or unauthorised destruction of personal information, and unlawful access to or processing of it, and it does not prescribe a specific tool or control (section 19 of POPIA). What you must be able to show is a process: you identified the foreseeable internal and external risks, put safeguards against them in place, checked that they work, and updated them when risks changed.

Section 19(3) adds that you must have due regard to generally accepted information security practices and procedures, including any required by industry or professional rules. For a financial advisor or a medical practice, the professional body's rules therefore sit on top of the Act. POPIA CRM security is therefore judged on process rather than product.

For a CRM, the controls below are the ones a reasonable reading of section 19 points to. The list is practical judgement, not wording from the Act:

• Each person has their own login, and former staff lose access on their last day.
• Roles limit who can see all contacts, who can edit and who can export.
• Multi-factor authentication is switched on wherever the platform offers it.
• Integrations and connected apps are listed, and any nobody uses are disconnected.
• Someone reviews who holds admin rights on a set schedule, and the review is written down.

The last point is the one most small businesses miss. Section 19(2) asks you to verify regularly that safeguards are effective, so a dated note saying "admin and export rights reviewed" is evidence, whereas a setting nobody has looked at since launch is not.

The Section-by-Section Map From the Act to Your CRM Settings

A CRM POPIA checklist is simplest as a map: each relevant section of the Act, what it means for the system, and the evidence you should be able to produce. The table below is that map, and the sections that follow explain the less obvious rows.

Does Your CRM Vendor Need a Written Operator Contract?

Yes: section 21(1) says a responsible party must, in terms of a written contract between it and the operator, ensure that the operator establishes and maintains the security measures referred to in section 19 (section 21 of POPIA). Section 21(2) adds that the operator must notify you immediately where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person.

For a mainstream CRM this contract is normally the vendor's own data processing terms, accepted when you sign up or on request. The task is to find them, read the security and breach-notice clauses, and file a copy. The structure of these agreements is covered in our post on POPIA operator agreements.

Check the same thing for every connected tool. A Meta lead form synced to the CRM, a WhatsApp inbox or an email platform that receives exports is another place personal information is processed, and each needs the same contract question answered. Whether a given vendor counts as an operator on its terms is a question for your attorney.

What Happens When the CRM Stores Data Outside South Africa?

Section 72(1) says a responsible party in South Africa may not transfer personal information about a data subject to a third party in a foreign country unless one of the listed grounds applies, such as the recipient being subject to adequate legal protection, the data subject consenting, or the transfer being necessary to perform a contract (section 72 of POPIA). On a plain reading, a CRM whose servers sit abroad raises exactly this question.

The practical step is to find the vendor's own statement of where your account's data is stored and which regions you can choose, and record it. We have not made hosting claims about named platforms here, because location options differ by plan and change over time; read the vendor's current page and date your note. Our post on POPIA cross-border transfers goes through the grounds in detail.

Section 18(1) also lists, among the matters you take reasonably practicable steps to make people aware of, the fact that you intend to transfer information to a third country and the level of protection afforded (section 18 of POPIA). Your privacy notice should therefore say, where applicable, that your CRM is hosted abroad.

How Do Retention and Access Requests Work Inside a CRM?

CRM POPIA retention means a record must not outlive its purpose: section 14(1) says records must not be kept longer than necessary for achieving the purpose they were collected for, unless an exception applies, and section 14(4) says to destroy, delete or de-identify them as soon as reasonably practicable once authority to keep them ends (section 14 of POPIA). A CRM makes over-retention easy, because deleting nothing is the default.

Decide what "purpose has ended" means for each record type: a lost lead, a closed customer, a former supplier. Legal or tax retention duties may require you to keep some records, so check those before deleting. That decision belongs with your attorney or accountant, and the CRM just needs a rule someone runs, including on synced email and notes.

Access requests are the second test. Section 23(1) lets a person with adequate proof of identity ask you to confirm, free of charge, whether you hold their information.

They can also ask for the record or a description of it, including who third parties with access are or have been (section 23 of POPIA). If one person exists as a contact, a deal, a note, an attachment and an entry in your email tool, you need to find all of them. Run the search on yourself once; our post on POPIA data subject access requests covers the response process.

What about marketing consent stored in the CRM?

Section 69(1) prohibits direct marketing by any form of electronic communication, including automatic calling machines, fax, SMS and email, unless the person has consented or is, subject to section 69(3), a customer of the responsible party (section 69 of POPIA).

The customer exception has conditions: you must have obtained the contact details in the context of a sale of a product or service, the marketing must be for your own similar products or services, and the person must have had a reasonable opportunity to object, free of charge. A contact sitting in your CRM is not automatically a customer. Section 69(4) requires each message to identify the sender and give an address for stopping future messages.

A CRM supports this only if consent is stored as data: a consent status, the date, the source form and the wording shown. Without those fields you cannot show on what basis you emailed someone, and an opt-out in your email tool will not reach the CRM. The rules for sending are in POPIA for marketing.

What Must You Do If the CRM Is Compromised?

If there are reasonable grounds to believe an unauthorised person has accessed or acquired personal information, section 22(1) requires you to notify the Information Regulator and, unless their identity cannot be established, the affected people, as soon as reasonably possible after discovery (section 22 of POPIA).

The Regulator's own page says notifications have gone through its eServices portal since 1 April 2025, and that all security compromises must be reported irrespective of the deemed level of risk (Information Regulator).

Affected people must be told in writing, by post, email to their last known address, a prominent notice on your website, the news media, or as the Regulator directs (section 22(4)). If your CRM holds a clean email address and mobile number for each contact, that part is workable; if it does not, you cannot reach them quickly.

The vendor's duty to notify you under section 21(2) does not discharge your own. Write a one-page plan now: who decides a compromise has happened, who files on the portal, who contacts customers and from which list. The full process is in our post on POPIA security compromise notification.

The Act also sets out enforcement. The administrative fine the Regulator may impose is capped at R10 million, subject to a CPI adjustment by the Minister (section 109 of POPIA). Treat that as the ceiling, not a prediction for a small business.

The CRM POPIA Checklist Before You Sign or Renew

A pre-signing checklist turns the sections above into questions you can ask a vendor and answer yourself, so the evidence exists before anything goes wrong. Work through it in order:

1. Find the vendor's data processing terms, read the security and breach-notice clauses, and file a copy.
2. Record where your account's data is stored and the vendor's stated basis for any transfer abroad, and add the fact to your privacy notice.
3. Set per-user logins, roles and export limits, and switch on multi-factor sign-in.
4. List every integration and connected app, and remove the ones nobody uses.
5. Add consent status, date and source fields, and confirm opt-outs flow both ways.
6. Write a retention rule per record type and put the first clean-up in the diary.
7. Run a search for one real person across the whole system to test an access request.
8. Write the one-page breach plan and name the registered information officer.

Our wider CRM data governance checklist goes into field ownership and data quality, which sit alongside these security duties. If you are comparing platforms first, ask each vendor items 1 and 2 before you look at pricing; our comparisons of HubSpot vs Pipedrive and Zoho CRM vs Bigin cover the commercial side.

Why South African Businesses Choose Growth Pulse Media

Growth Pulse Media is a Johannesburg digital agency working across Google Ads, Meta Ads, GA4 and Shopify, and it advises on what personal data lead forms and advertising collect before that data reaches a CRM.

Dirk van Greuning built and scaled a large South African ecommerce business before founding Growth Pulse Media, and that operator background shapes how we advise. Our work sits on the acquisition and measurement side, across Google Ads, Meta Ads, GA4 and Shopify, and our digital strategy work decides what a lead form should ask, record and pass on. All work is executed in-house, with a limited client load so senior attention stays on your account.

Who This Is Not For

This post is not for readers who need legal advice, a CRM configured for them, or certainty about a specific vendor's hosting.

Frequently Asked Questions

Is my CRM subject to POPIA?

Yes, if it holds personal information about identifiable people, such as names, phone numbers, email addresses or conversation notes. You are the responsible party, and the CRM vendor is usually an operator acting for you. The duties in sections 19 to 22 apply to the data in the system whichever platform you use.

Does my CRM vendor have to sign a contract with me under POPIA?

Section 21(1) requires a written contract between you and the operator that makes it establish and maintain the section 19 security measures. For most CRM platforms that is the vendor's data processing terms, so find them, read the security and breach-notice clauses and keep a copy. Your attorney can confirm how they apply on your plan.

Can I use a CRM hosted outside South Africa under POPIA?

It is possible, but section 72 says personal information may be transferred to a third party in a foreign country only if a listed ground applies, such as adequate legal protection in the recipient's country or the person's consent. Find the vendor's stated storage location, record the ground you rely on, and mention the transfer in your privacy notice. Your attorney should confirm how a ground applies to cloud hosting.

What must I do if my CRM is hacked?

Under section 22 you must notify the Information Regulator and the affected people as soon as reasonably possible after discovery. The Regulator has taken these notifications through its eServices portal since 1 April 2025, and says all compromises must be reported irrespective of the deemed level of risk. Have a written plan before it happens.

How long can I keep contacts in my CRM?

Section 14 says records must not be kept longer than necessary for the purpose they were collected for, unless an exception applies, and must be deleted, destroyed or de-identified once authority to keep them ends. The Act gives no single period, so set a rule per record type and check any legal or tax retention duties first.

Dirk van Greuning Founder, Growth Pulse Media

Founder of Growth Pulse Media and a specialist in South African search dominance. Dirk translates his experience in scaling South African businesses into high-velocity digital strategies for B2B and retail leaders. He writes about SEO, lead generation, and paid media from an operator's perspective — prioritising pipeline value over impressions.

Connect on LinkedIn