POPIA,bydesign

Every sensitive data flow is covered by a formal POPIA Data Protection Impact Assessment. Every retention window is tenant-configurable. Every purge emits a tamper-evident destruction certificate.

VaultFuzion is a product of Kapardyn, a subsidiary of Synchplus Consulting (Pty) Ltd, a company registered in the Republic of South Africa. All customer data is processed under South African law.

Data Protection Impact Assessments

Each entry below summarises a formal DPIA we maintain on record. Specific retention parameters are confirmed in your signed agreement and surfaced to you through the Partner Portal.

Microsoft 365 mailbox backup

Legal basis: POPIA §11(1)(d), legitimate interest via your Microsoft data-processing agreement

Retention: Tenant-configurable retention; tamper-evident destruction certificate on purge

Entra ID identity backup

Legal basis: POPIA §11(1)(d), legitimate interest; contract performance

Retention: Point-in-time identity snapshots on your retention schedule; destruction certificate on purge

Teams · SharePoint · OneDrive backup

Legal basis: POPIA §11(1)(d), legitimate interest via your Microsoft data-processing agreement

Retention: Follows your existing mailbox-backup retention; no additional storage class

eDiscovery & legal-hold export

Legal basis: POPIA §11(1)(d), legitimate interest; §14 legal-hold obligation

Retention: Held for the duration of the legal hold; released and destructible on your instruction

Retention lifecycle and destruction

Legal basis: POPIA §14, purpose limitation and minimum-retention principle

Retention: Tenant-configurable schedules; tamper-evident destruction certificates

Continuous compliance checks

The platform runs these checks for every tenant on an ongoing basis, surfacing any gap to the responsible partner before it becomes an audit finding.

Retention policy present and current

Encryption at rest and in transit

Tamper-evident audit trail active

Active backup protection in place

Role-based access controls configured

Data residency confirmed (South Africa)

Consent and legal basis recorded

Legal-hold awareness enabled

Proof of deletion available

Purpose limitation respected

Data minimisation applied

Breach notification readiness

Right-to-deletion workflow enabled

LAST REVIEWED · 2026-05-07 · POPIA scoring is operational, not a regulatory verdict.