Sometimes, particular data are private, and in other contexts, it is not. That means that, to comply with PoPIA, a data-centric approach to data security must be applied that takes the purpose for which data is being used, and who is accessing it, into account.