A Data Breach Is Not Just a Technical Problem — It's a Legal One
When personal information is compromised in South Africa, the Protection of Personal Information Act (POPIA) imposes strict legal obligations on the affected organisation. Failing to comply can result in fines of up to R10 million, imprisonment, and significant reputational damage.
Yet many SA businesses still don't have a data breach response plan, and many don't understand their legal obligations when a breach occurs.
What Counts as a Data Breach Under POPIA?
A "security compromise" under POPIA Section 22 includes any situation where there are reasonable grounds to believe that personal information has been:
- Accessed by an unauthorised person
- Acquired by an unauthorised person
- This includes both cyber attacks (hacking, ransomware, phishing) and physical breaches (stolen laptops, lost documents, improper disposal of records)
Your 5 Legal Obligations When a Breach Occurs
1. Notify the Information Regulator
POPIA requirement (Section 22(1)): You must notify the Information Regulator "as soon as reasonably possible" after discovering the breach.
What to include in the notification:
- Description of the possible consequences of the breach
- Description of the measures taken or to be taken to address the breach
- A recommendation regarding measures the data subjects can take to mitigate possible adverse effects
- The identity of the unauthorised person who may have accessed the information (if known)
2. Notify Affected Data Subjects
POPIA requirement (Section 22(1)): You must also notify the individuals whose personal information was compromised.
How to notify: By mail, email, or prominent placement on your website. If direct notification is not possible (e.g., you don't have contact details), you must publish in the media.
What to include: The same information provided to the Information Regulator, plus what steps data subjects can take to protect themselves.
3. Investigate the Breach
What to do:
- Determine how the breach occurred
- Identify what information was compromised
- Assess how many data subjects are affected
- Determine whether the compromised data has been misused
- Implement immediate measures to contain the breach
4. Remediate and Prevent Recurrence
POPIA requirement (Section 19): You must implement "appropriate, reasonable technical and organisational measures" to prevent future breaches.
Practical steps:
- Patch the vulnerability that was exploited
- Change compromised passwords and access credentials
- Review and strengthen access controls
- Update security policies and procedures
- Conduct staff training on data protection
5. Document Everything
Why: The Information Regulator may investigate, and you'll need to demonstrate that you took appropriate steps. Complete documentation of the breach, your response, and remediation measures is essential.
Delayed Notification: When Can You Wait?
The Information Regulator or the South African Police Service (SAPS) may direct you to delay notification to data subjects if it would impede a criminal investigation. Other than this specific exception, delay is not permitted.
Penalties for Non-Compliance
POPIA Section 107 offences include:
- Failing to notify the Information Regulator of a breach
- Failing to notify data subjects
- Obstruction of the Information Regulator
Penalties:
- Administrative fines up to R10 million
- Imprisonment up to 10 years (for serious offences under Section 107)
- Civil claims from affected data subjects for actual damages suffered
How Breaches Affect Your Contracts
A data breach doesn't just create regulatory exposure — it can trigger obligations under your contracts:
- Operator agreements may require you to notify the responsible party whose data you were processing
- Client contracts may include breach notification timelines (often stricter than POPIA's "as soon as reasonably possible")
- Insurance policies may require notification within a specific timeframe to maintain coverage
- Service level agreements may impose service credits or termination rights for security failures
Building a Data Breach Response Plan
Every SA business that processes personal information should have a written breach response plan that includes:
1. Incident classification criteria — how to determine if an incident qualifies as a POPIA-notifiable breach
2. Roles and responsibilities — who leads the response (IT, legal, management)
3. Containment procedures — immediate steps to stop ongoing compromise
4. Notification templates — pre-drafted notices for the Information Regulator and data subjects
5. Communication plan — who communicates with media, clients, and employees
6. Post-incident review — how to learn from the breach and prevent recurrence
Protect Your Business
Ensure your contracts include proper data breach notification clauses, operator agreements, and security obligations. Use ContractGuard to analyze your contracts for POPIA compliance and identify gaps in your data protection provisions.