09/10/2026
If your business discovered a data breach this morning, would your team know who has to be notified?
Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, POPIA requires the responsible party to notify the Information Regulator and affected data subjects, unless the identity of a data subject cannot be established.
The Regulator's guidance is also clear on timing: report once the responsible party is reasonably sure a security compromise has occurred. The investigation does not have to be complete first.
That makes preparation important. Before an incident happens, a business should know:
• Who is the Information Officer or Deputy Information Officer responsible for escalation?
• How will the incident be contained and documented?
• Which personal information and data subjects may be affected?
• How will the required notifications be handled?
• What do contracts with operators or service providers require when the incident starts outside your own systems?
Security compromise notifications to the Regulator are submitted through its eServices portal.
Cybersecurity Awareness Month is a useful reminder to test the legal response plan as well as the technical one.
For advice on POPIA obligations, incident response and commercial arrangements with operators, call 021 461 0123 or email [email protected].