Short answer
No. No provider can promise POPIA compliance on its own. FirstNet sets up each security service to match your privacy, retention and audit needs. But compliance is shared. It depends on how you set up and run your own systems.
In detail: POPIA compliance for cybersecurity services
What FirstNet can give you is controls and proof that support compliance:
- Data loss prevention through Cloudflare, to spot and block personal information leaving the business
- FortiAnalyzer as a Service, hosted in South Africa, so log data stays in the country in normal use
- Mimecast, which supports keeping data in South Africa, with archiving for retention and legal hold where agreed
- Reports and audit trails from FortiAnalyzer, Sophos NG-SIEM and the other platforms
Under POPIA, your business is still the responsible party. That means you answer for the personal information you hold. Your duties to the people whose data you keep stay with you, and so does your own governance. FirstNet itself runs ISO 27001 and ISO 9001 management systems.
Do you need a formal questionnaire filled in, or special contract wording, such as where data is kept? FirstNet's product and legal teams check the request before we agree to anything.
Source: FirstNet Security service page →