We are not your lawyers. If you need a legal opinion on POPIA, get one. What we see, as the people who run the mail and the backups, is the gap between the policy on the website and the server in the cupboard.
Mail holds personal information. A shared mailbox called 'info@' that twelve ex-employees can still open is an access problem, not an IT tidy-up. Leavers should lose access when they leave, including the phone that still syncs.
Backups copy that problem into the past. If you keep every mailbox forever because the disk is large, you are keeping personal information you may no longer have a reason to keep. Retention should be a decision. We can enforce a technical limit. We should not invent the number of years for you.
Restores are access too. If anyone who knows the server password can export a mailbox, you do not have a control, you have a habit. Named accounts, and a note of who restored what, are dull and useful.
The same thinking applies to guest Wi-Fi logs and to CCTV if that sits on a network we manage. Collect less, keep it for a stated time, and do not leave it in a share called Backup-OLD.
If you want the technical side lined up with a policy you already have, say that when you book. Bring the policy. We will not draft one on a call.