POPIA requires responsible parties to secure personal information through appropriate, reasonable technical and organisational measures and to respond to security compromises through the required notification process. Database controls form part of that wider responsibility, but POPIA compliance also depends on governance, policies, people, and incident management. Seek appropriate legal advice for the application of POPIA to a specific incident or environment.