Records & POPIA
Data Classification Coverage
Extent to which information assets are classified by sensitivity to support POPIA-aligned protection.
You cannot protect personal information you have not classified
POPIA obligates a responsible party to secure the integrity and confidentiality of personal information through appropriate, risk-based safeguards, and that calibration is impossible unless information assets are first classified by sensitivity. Unclassified data is, by default, under-protected or over-protected. AuditPro Core measures classification coverage across the information estate so that sensitive and special personal information is identified and protected proportionately, supporting the POPIA accountability and security-safeguards conditions.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Repositories classified
83%
▲ 11 pts
Unclassified with PII
44
Special-category stores
29
Repositories scanned
318
Repositories by classification level
Unclassified repositories holding PII
| Repository | Owner | Records | Risk |
|---|---|---|---|
| Legacy HR share | HR | 84000 | High |
| Clinic intake files | Health | 51000 | High |
| Indigent register | Revenue | 132000 | Medium |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
Classification drives proportionate control
Security safeguards must be appropriate to the sensitivity of the data. Without a classification scheme, controls are applied uniformly, leaving the most sensitive information no better protected than routine records.
Special personal information
POPIA singles out categories such as health, biometric, religious and children's information for stricter treatment. Classification is how these higher-risk categories are identified for the additional controls the Act requires.
Coverage as the key metric
The risk lives in what remains unclassified. A high classification percentage with a residual tail of unassessed assets still leaves an exposure, so coverage and the unclassified remainder are both tracked.
Classification must be maintained
Data sensitivity changes as records are created, combined and repurposed. A classification done once and never revisited drifts out of date and loses its protective value.
How AuditPro Core Bridges the Gap
- Coverage measurement: the proportion of information assets carrying a sensitivity classification is tracked against the full estate.
- Special-category flagging: assets containing special personal information are highlighted for stricter controls.
- Exception workflow: unclassified or stale-classified assets are routed to data owners for assessment.
- Continuous monitoring: classification currency is re-tested so newly created assets are brought into scope.
Key Takeaways
- Proportionate POPIA safeguards depend on first classifying data by sensitivity.
- Special personal information needs identification for the stricter controls POPIA requires.
- Track the unclassified tail; that is where the protection gap sits.
- Maintain classifications, since data sensitivity changes as records are repurposed.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.