The POPI Act will apply to all schools.In summary, all schools are required to put appropriate and reasonable technical and organisational measures into place to secure the integrity and confidentiality of any personal information in their possession or control. The school must establish and maintain both technological and physical safeguards in respect to all electronic/digital and physical personal data. The school must identify reasonably foreseeable risks, and regularly verify that all safeguards are effective and then updated in response to control breaches or new risks.