Outside-in exposure monitoring for POPIA's security safeguards duty
SurfaceDiff compares your public-facing infrastructure with its previous snapshot and alerts your team when ports, services, DNS records, certificates or observed hosts change.
That gives you a timestamped record that your externally visible risk picture is actually being checked and re-checked - evidence for Condition 7's security safeguards duty under Section 19, not a one-off scan filed away and forgotten.
Free ongoing monitoring. One verified domain. No credit card.
SurfaceDiff supports selected technical processes. It does not provide legal advice, certification or a guarantee of POPIA compliance.
You can have every safeguard documented and still not know what's reachable today
A security policy can be written, approved and filed, yet the infrastructure it describes keeps moving underneath it. A test port stays open after the test ends, a staging subdomain goes live and is never taken down, a certificate gets renewed and nobody checks the result.
Section 19 doesn't just ask you to put safeguards in place once - it asks you to identify foreseeable risks, and to regularly verify those safeguards are still effectively implemented. That's an ongoing duty, not a document you write and file.
SurfaceDiff adds the recurring, outside-in half of that check: what does the public internet actually see today, and what changed since the last time it looked.
Where outside-in monitoring supports POPIA's Condition 7
POPIA sets out eight conditions for lawful processing of personal information. Condition 7 - Security Safeguards (Sections 19 to 22) - is the one genuinely relevant to external exposure monitoring.
POPIA doesn't prescribe a fixed list of controls. It's risk-based: identify your foreseeable risks, build proportionate safeguards, verify they're still working, and update them as risks change. SurfaceDiff can contribute evidence and visibility to the external, outside-in slice of that duty. It does not satisfy Condition 7 on its own.
| Relevant area | How SurfaceDiff can contribute | What SurfaceDiff does not replace |
|---|---|---|
| Security measures - identify & verify (Section 19) | Scans your verified domains on a schedule and diffs each result against the last - a continuous, timestamped record that your externally visible risk picture is actually being checked and re-checked, not assessed once and left. | Does not cover internal safeguards - encryption, access control, staff training, network segmentation - and doesn't by itself make your measures "appropriate" or "reasonable" under Section 19. |
| Security compromise notification (Section 22) | A port or service that's suddenly reachable when it wasn't before is exactly the kind of signal that should prompt a check for a possible compromise - with a timestamped before/after record to support that review. | Does not detect or confirm an actual data breach, does not determine whether personal information was accessed, and does not file the Information Regulator's notification for you. |
| Operator due-diligence & client evidence | If a client asks you to demonstrate your security safeguards - increasingly common under POPIA operator agreements - a signed, timestamped audit trail is a direct answer instead of a promise. | Does not replace the written operator agreement itself (Section 20/21), and does not cover your client's own internal data handling. |
| Knowing your own external footprint | Keeps a running history of the subdomains, ports, services and certificates observed in your verified scope - the starting context for deciding what "reasonable" safeguards even need to cover. | Not a complete or authoritative asset inventory - it only sees what's externally discoverable within domains you've verified. |
Security measures - identify & verify (Section 19)
How SurfaceDiff can contribute
Scans your verified domains on a schedule and diffs each result against the last - a continuous, timestamped record that your externally visible risk picture is actually being checked and re-checked, not assessed once and left.
What SurfaceDiff does not replace
Does not cover internal safeguards - encryption, access control, staff training, network segmentation - and doesn't by itself make your measures "appropriate" or "reasonable" under Section 19.
Security compromise notification (Section 22)
How SurfaceDiff can contribute
A port or service that's suddenly reachable when it wasn't before is exactly the kind of signal that should prompt a check for a possible compromise - with a timestamped before/after record to support that review.
What SurfaceDiff does not replace
Does not detect or confirm an actual data breach, does not determine whether personal information was accessed, and does not file the Information Regulator's notification for you.
Operator due-diligence & client evidence
How SurfaceDiff can contribute
If a client asks you to demonstrate your security safeguards - increasingly common under POPIA operator agreements - a signed, timestamped audit trail is a direct answer instead of a promise.
What SurfaceDiff does not replace
Does not replace the written operator agreement itself (Section 20/21), and does not cover your client's own internal data handling.
Knowing your own external footprint
How SurfaceDiff can contribute
Keeps a running history of the subdomains, ports, services and certificates observed in your verified scope - the starting context for deciding what "reasonable" safeguards even need to cover.
What SurfaceDiff does not replace
Not a complete or authoritative asset inventory - it only sees what's externally discoverable within domains you've verified.
Sections 20 and 21 - the written agreement between a responsible party and an operator - are a contractual obligation between you and your client, not something a monitoring tool can fulfil.
Where you fit: responsible party or operator
POPIA draws a line between a responsible party (decides why and how personal information is processed) and an operator (processes it for someone else, under contract). Hosting providers and MSPs are often both at once, for different data: an operator for the client data they process on a client's behalf, and a responsible party for their own business data - employee records, billing, their own customer accounts.
In its core monitoring function, SurfaceDiff observes externally visible infrastructure metadata - DNS records, open ports, service fingerprints, TLS certificates - for domains you've verified ownership of. It isn't reading personal information or data-subject records, so it generally doesn't make SurfaceDiff an "operator" of personal information under POPIA in that function. If your situation is unusual, confirm the classification with your own adviser.
A separate check of what the internet can see
Verify your domain
Domain verification confirms the monitored scope is authorised before anything is scanned.
Establish an external baseline
SurfaceDiff records the public-facing state of observed hosts, DNS, ports, service fingerprints and TLS certificates.
Check the exposure on a schedule
Automated scans repeat daily on the Free plan, up to hourly on paid plans - no agent required inside your environment.
Compare snapshots
Each new observation is compared with the previous snapshot to identify what appeared, disappeared or changed.
Give the change to a human
SurfaceDiff raises an incident and preserves the change history so someone can confirm the result was intended or investigate it.
Operational evidence for a client, an auditor or the Regulator
A point-in-time scan shows what's exposed right now. SurfaceDiff adds the history needed to show when an observed change appeared and what the previous state looked like.
The resulting snapshots, timestamps, change details and incident history can contribute supporting operational evidence - for your own review, for a client's due-diligence questionnaire, or during an inquiry. Whether particular evidence is sufficient is for you, your adviser, your client or the Regulator to determine.
- Timestamped external snapshots
- Previous and current observed values
- An audit trail of who reviewed what, and when
- Signed Evidence Packs you can hand to a client or auditor
- A consistent outside-in point of view
Relevant to any business that handles personal information in South Africa
POPIA applies to any responsible party processing personal information in South Africa - there's no size or turnover exemption. SurfaceDiff is particularly useful to hosting providers, MSPs and agencies managing many client domains across shared infrastructure, where knowing what changed externally - and proving you checked - is harder to do by hand as the footprint grows.
If you're not sure how POPIA applies to your organisation, confirm your obligations with a qualified adviser or the Information Regulator.
A supporting control, not a compliance shortcut
SurfaceDiff does
- Monitor your verified public-facing scope from the outside, on a schedule
- Compare each scan against the last one and flag genuine change
- Keep a timestamped history of ports, services, DNS, subdomains and certificates
- Give you an audit trail of who reviewed a finding, and when
- Produce a signed Evidence Pack you can hand to a client or auditor
SurfaceDiff does not
- Certify or guarantee POPIA compliance
- Provide legal advice
- Appoint or register your Information Officer
- File a security-compromise notification with the Information Regulator
- Manage consent, data subject requests or retention policy
- Monitor or secure data that isn't externally reachable
FAQ
Does POPIA apply to my business?
Generally yes. POPIA applies to any responsible party processing personal information in South Africa, with no exemption based on company size or turnover. Confirm your specific obligations with a qualified adviser.
Does SurfaceDiff make my company POPIA compliant?
No. SurfaceDiff is a technical monitoring service that can support the Condition 7 security-safeguards duty around your external exposure. Compliance depends on your organisation's complete set of legal, technical and organisational measures.
What counts as "reasonable technical and organisational measures" under Section 19?
POPIA doesn't prescribe a fixed list - it's risk-based and proportionate to what you process. Commonly cited elements include encryption, access control, logging and regular security review. The "regularly verify" and "continually update" parts of that duty are where recurring outside-in monitoring fits.
Is POPIA the same as GDPR?
They share a lineage and similar structure, but differ in practice - POPIA also covers juristic persons (not just individuals), doesn't carry GDPR's distinct "processor" concept in the same form, and sets lower fine ceilings than GDPR.
Does hosting in South Africa make me POPIA compliant?
No. South African hosting mainly affects the cross-border transfer analysis under Section 72 - it's one relevant factor, not a substitute for the rest of your compliance programme.
Do I need to appoint an Information Officer?
Yes. Every responsible party must appoint an Information Officer and register them with the Information Regulator before they act in that role.
Where do hosting providers and MSPs fit - responsible party or operator?
Often both, for different data. You're typically an "operator" for the data you process on a client's behalf, and a "responsible party" for your own business data - employee records, billing, your own customer accounts. See the section below for how that affects what SurfaceDiff can and can't help with.
Can SurfaceDiff's history be used as evidence for a client questionnaire or an Information Regulator inquiry?
It can contribute supporting operational evidence - timestamped history and signed Evidence Packs. Whether particular evidence is sufficient for a specific situation is for your advisers, your client or the Regulator to judge.
Official references
Related
See what's exposed, and keep proof you checked
Start with one domain and see how SurfaceDiff records changes to the infrastructure visible from the public internet.
Start a Free ScanOne verified domain. No credit card required.
SurfaceDiff is a technical monitoring service. It does not provide legal advice, compliance certification or assurance that an organisation satisfies POPIA or any other data-protection law. References to POPIA describe areas in which external exposure monitoring may provide supporting visibility or evidence for the security safeguards duty under Condition 7. Organisations should assess their obligations with qualified advisers and the Information Regulator.