It usually starts with a phone call on a Monday morning. The systems are down, files are encrypted, or a client reports a suspicious email sent from your domain. In the next few days, the decisions you make will determine not only how quickly you recover, but how much legal exposure your business faces.
Cyberattacks on South African businesses are no longer rare. The Information Regulator has received more than 8,000 security compromise notifications since POPIA’s enforcement provisions took effect, and over 1,200 between April and August 2026 alone. The most common causes are not sophisticated attacks. They are weak passwords, inadequate security controls, employee mistakes and ransomware.
Your legal obligations after a breach
Under section 22 of the Protection of Personal Information Act 4 of 2013 (POPIA), where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party must notify:
- the Information Regulator; and
- the affected data subjects, unless their identity cannot be established,
as soon as reasonably possible after discovering the compromise. A delay is permitted only for the legitimate needs of law enforcement, or to determine the scope of the compromise and restore the integrity of the system.
Since April 2025, the Regulator requires security compromise notifications to be submitted through its online eServices portal.
The notice to affected people must be in writing and must give enough information for them to protect themselves, including:
- a description of the possible consequences of the breach;
- the measures the business has taken or intends to take;
- recommendations for what they should do to mitigate the effects; and
- if known, the identity of the unauthorised person.
If you use an IT service provider, cloud host or payroll bureau (an “operator”), POPIA requires the operator to notify you immediately of any breach. Check that your contracts say so.
The Regulator is not just looking at the hackers
In August 2026, the Regulator issued an enforcement notice against the South African Bureau of Standards following a ransomware attack. The Regulator made clear that the action was based on the underlying compliance failures, including inadequate security safeguards, excessive processing and inadequate consent mechanisms, and not on the fact that SABS had been attacked.
That is the key lesson for business owners. Being the victim of a cybercrime is not a defence. The question the Regulator will ask is whether you had appropriate, reasonable technical and organisational measures in place, as section 19 of POPIA requires.
What are the consequences?
- Enforcement notices requiring specific remedial steps within a deadline.
- Administrative fines of up to R10 million. The Regulator has fined the Department of Justice R5 million following a cyberattack in which it lost about 1,200 files.
- Criminal penalties for certain offences, including failure to comply with an enforcement notice.
- Civil claims by affected individuals for damages under section 99, which may be brought as class actions.
- Reputational harm and lost contracts, which are often more costly than any fine.
The Regulator has also proposed amending POPIA so that fines can be imposed immediately on a finding of non-compliance, rather than only after a business fails to comply with an enforcement notice. That change is not yet law, but the direction is clear.
The first 72 hours: a practical checklist
- Contain the incident. Isolate affected systems and preserve logs. Do not wipe evidence.
- Call your lawyer and your cyber insurer early. Many policies require prompt notification and the use of approved forensic firms. Legal involvement may also help protect sensitive reports.
- Establish what was compromised. Whose personal information, what categories, and how many people.
- Notify the Regulator through the eServices portal and notify affected individuals as soon as reasonably possible.
- Report the crime to SAPS, and consider other obligations under the Cybercrimes Act, sector regulators, banks or your clients’ contracts.
- Be careful with ransom demands. Paying does not guarantee the data will be deleted and may raise legal and insurance issues.
- Communicate consistently. One approved message to clients, staff and the media.
- Document everything. The Regulator will want to see what you knew, when, and what you did.
Reducing your exposure now
- Appoint and register your information officer, and make sure they understand their role.
- Conduct a personal information impact assessment and keep it up to date.
- Implement multi-factor authentication, regular patching, backups stored offline, and access controls.
- Train staff to recognise phishing. Many breaches start with one click.
- Review operator agreements with IT providers and other suppliers.
- Have a written incident response plan, and test it.
- Review your cyber insurance cover and its notification requirements.
How O’Reilly Law can help
We help businesses prepare for and respond to data breaches, including incident response, notifications to the Information Regulator and data subjects, dealing with enforcement notices, and claims by and against service providers. We also review POPIA compliance frameworks and IT contracts. Contact us before an incident, or as soon as one happens.
Related reading: Directors’ personal liability · Using AI in your business: the legal risks
This article is general information and not legal advice. Correct as at October 2026.