We picture a data breach as something cinematic. A hooded figure, green code scrolling down a black screen, a genius somewhere overseas cracking our firewall at three in the morning. It makes for good television. It also, quietly, lets us off the hook, because it suggests the danger is out there, sophisticated, and somebody else’s problem to solve.
The truth is far more ordinary, and far closer to home. The breach that exposes a South African retirement fund almost never arrives as a dramatic hack. It arrives as an email.
A trustee forwards the board pack to a personal Gmail so they can read it over the weekend. An administrator sends a member schedule (names, ID numbers, cell numbers) to the wrong “Sally” in the address book. The spreadsheet is password-protected, but the password is the same one everyone uses: the fund name plus the year. A service provider attaches an unencrypted file and hits send. Nobody broke in. We handed the data over ourselves.
Why this is a bigger deal than it feels like
POPIA, the Protection of Personal Information Act, is the law that governs how we look after people’s personal information. In plain
terms, it says the member data your fund holds isn’t really yours. You are holding it on trust, and you are responsible for keeping it safe. A leak of member information isn’t just embarrassing. It can carry real regulatory consequences, and it lands on the board’s desk, not the hacker’s.
Here’s the uncomfortable part: most of the risks that lead to a POPIA problem are boring. They don’t look like threats. They look like Tuesday.
The unglamorous risks boards keep underestimating
The board pack sitting on someone’s laptop in an airport lounge, screen unlocked. The WhatsApp group where trustees “quickly” share a resolution. The retired trustee (often our most diligent reader) using an old device with no password and no anti-virus. The habit of emailing sensitive files back and forth between the fund and its administrators because “that’s how we’ve always done it.”
None of these feel dangerous in the moment. That’s exactly why they persist. And each one is a door left open.
What actually helps
You don’t need to become a cybersecurity expert. You need a few unglamorous habits, applied consistently.
Stop moving member data or sensitive files through email. If sensitive documents live in one secure, access-controlled place where trustees log in to view them rather than downloading copies, you remove the single most common way funds leak information.
Lock the devices. Insist that every laptop and phone touching fund material locks itself after a few minutes and needs a password to open. It takes two minutes to set up and closes a surprising number of doors.
Stop moving member data or sensitive files through email. If sensitive documents live in one secure, access-controlled place where trustees log in to view them rather than downloading copies, you remove the single most common way funds leak information.
Lock the devices. Insist that every laptop and phone touching fund material locks itself after a few minutes and needs a password to open. It takes two minutes to set up and closes a surprising number of doors.
Treat “view only” as your default. If files can’t be downloaded, a lost or stolen laptop stops being a crisis. Or ensure that all downloaded files require a password every time they are opened.
Talk about phishing, out loud, regularly. Most breaches begin with someone clicking a link they shouldn’t. A fifteen-minute reminder now and then does more than any firewall.
The point
Good governance has always been about the boring things done well: the minutes kept, the conflicts declared, the questions asked. Data protection is no different. It is not glamorous, and it will never make headlines the way a hack would.
But when the day comes that a regulator asks how your fund protected members’ information, “we were careful with our email” is not an answer you want to be reaching for. The threat was never the genius overseas. It was the send button, and the habit of trusting it.
