Choosing where to store your backups is no longer just an IT decision, it is a legal one. For any organisation handling personal information, a POPIA-compliant backup in South Africa means knowing exactly where your data physically lives, who can access it, and how quickly you can recover it after an incident. The Protection of Personal Information Act sets clear expectations for how responsible parties safeguard the data they hold, and backups are squarely in scope. Get it wrong and the consequences are real: non-compliance can attract penalties of up to R10 million, alongside reputational damage and the cost of a breach itself.
What POPIA actually expects from your backups
POPIA does not publish a tick-box “approved backup” checklist, but its security safeguards condition is unambiguous. As a responsible party, you must take reasonable, appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised access and unlawful processing. Backups are part of that obligation, because losing data to ransomware or hardware failure is itself a form of harm to the data subjects whose information you hold.
In practice this means three things for any backup strategy:
- Confidentiality — backups must be encrypted and access-controlled so a stolen copy is useless to an attacker.
- Integrity — you must be able to prove the data has not been tampered with.
- Availability — you must be able to restore within a reasonable timeframe to meet your operational and contractual duties.
Data residency: why “where” matters for POPIA
POPIA places conditions on transferring personal information outside South Africa. You can send data offshore, but only where the recipient is subject to comparable protection, or the data subject consents, or other narrow grounds apply. The simplest way to sidestep that complexity is to keep your backups in the country.
This is where the question of POPIA-compliant backup for South Africa gets practical. Many global cloud platforms replicate data across regions you cannot fully control, which makes proving residency and demonstrating accountability harder. Storing backups in a South African facility keeps your data under local jurisdiction, simplifies your cross-border assessment, and shortens the distance between your systems and your recovery copies, which usually means faster restores too.
The 3-2-1 rule, brought up to date
The 3-2-1 rule remains the most reliable framework for resilient backups, and it maps neatly onto POPIA’s availability requirement:
- 3 copies of your data.
- 2 different types of media or storage.
- 1 copy kept offsite, away from your primary site.
Modern threats have pushed many organisations towards a “3-2-1-1-0” variant: one of those offsite copies should be immutable, and you should aim for zero recovery errors by testing restores regularly. A backup you have never test-restored is a hope, not a plan.
Ransomware and the case for immutability
Ransomware operators now actively hunt for and delete backups before triggering encryption, because a victim who can restore will not pay. This is why immutability has become essential rather than optional. Immutable, write-once storage means a backup, once written, cannot be altered or deleted until a defined retention period expires, not even by an administrator whose credentials have been compromised.
Pairing immutability with an offsite copy gives you a clean, tamper-proof recovery point even if your production environment is fully encrypted. For most South African businesses, that single capability is the difference between a bad week and an existential event.
Why locally-hosted, S3-compatible offsite storage makes sense
S3-compatible object storage has become the de facto standard for backup targets because almost every modern backup tool can write to it natively. Choosing storage that speaks this common language means you are not locked into a single vendor’s software and can change backup tooling later without re-architecting where your data lives.
Combine that compatibility with local hosting and immutability and you have a backup target that satisfies residency, resilience and ransomware concerns at once. This is exactly the gap VaultPulse, LDD’s S3-compatible offsite backup and object storage is built to fill, hosted locally in South Africa and available self-managed, co-managed or fully managed depending on how much of the operational burden you want to keep in-house.
Choosing your management model
- Self-managed — you control retention, immutability windows and restores; ideal for teams with in-house capability who simply need a compliant, local target.
- Co-managed — LDD shares responsibility, helping with setup, policy design and monitoring while your team retains day-to-day control.
- Fully managed — LDD runs the whole backup lifecycle for you, including restore testing, so compliance and recoverability are handled end to end.
POPIA compliance is ultimately about being able to demonstrate that you took reasonable, deliberate steps to protect personal information. Keeping backups in South Africa, following an updated 3-2-1 rule, and building in immutability covers the three concerns that matter most: residency, resilience and ransomware. Get those foundations right and you turn your backup strategy from a quiet liability into evidence of genuine accountability.
Frequently asked questions
Does POPIA require me to keep my data backups in South Africa?
POPIA does not outright forbid storing backups offshore, but it places conditions on transferring personal information across borders, such as ensuring the recipient is subject to comparable protection or obtaining the data subject’s consent. Keeping backups in South Africa is the simplest way to avoid that added complexity, keep your data under local jurisdiction, and make accountability easier to demonstrate.
What is the 3-2-1 backup rule?
The 3-2-1 rule means keeping 3 copies of your data, on 2 different types of storage, with at least 1 copy offsite. A modern variant, 3-2-1-1-0, adds that one offsite copy should be immutable and that you should test restores until you achieve zero recovery errors. It is a practical way to meet POPIA’s requirement that data remain available and recoverable.
How does immutable backup storage protect against ransomware?
Immutable, write-once storage means a backup cannot be altered or deleted until its retention period expires, even by someone using compromised administrator credentials. Because modern ransomware deliberately targets and deletes backups before encrypting systems, an immutable offsite copy gives you a clean, tamper-proof recovery point so you can restore without paying a ransom.
What does S3-compatible storage mean and why does it matter?
S3-compatible object storage uses a widely adopted standard that almost every modern backup tool can write to natively. Choosing an S3-compatible target means you are not locked into one vendor’s software and can change your backup tooling later without re-architecting where your data is stored. It has become the de facto standard for backup destinations.
What are the penalties for POPIA non-compliance?
POPIA non-compliance can attract administrative fines and penalties of up to R10 million. Beyond the direct penalty, organisations face reputational damage, loss of customer trust, and the operational cost of recovering from a breach, which makes demonstrable safeguards like compliant backups a sound investment.
Can LDD manage our backups for us, or do we run them ourselves?
VaultPulse is available in three models. Self-managed lets your own team control retention, immutability and restores using a compliant local target. Co-managed shares responsibility, with LDD helping on setup, policy and monitoring. Fully managed hands the entire backup lifecycle, including restore testing, to LDD. You can choose based on your in-house capability and how much of the operational burden you want to keep.
Talk to LDD about how this applies to your business.
