A data breach can expose personal information, interrupt operations and undermine trust. When an email account is compromised, records are sent to the wrong person, or systems are attacked, a business must act quickly — but its legal response should be measured and accurate.
O’Reilly Law advises businesses on POPIA data breach response, helping decision-makers identify their notification obligations, manage regulator correspondence and contain their legal and commercial exposure.
Section 22 applies where there are reasonable grounds to believe that an unauthorised person has accessed or acquired personal information. The responsible party must notify the Information Regulator and affected data subjects as soon as reasonably possible after discovery, subject to statutory qualifications. There is no general 72-hour deadline under POPIA.
Notifications are submitted through the Information Regulator’s eServices portal. The response may also require assessing customer contracts, confidentiality undertakings, insurance conditions and potential claims. We coordinate legal decisions with forensic and cybersecurity specialists where appropriate.
A legal assessment should run alongside technical containment, not delay it. Where the facts remain uncertain, reports may need to be updated as reliable information emerges.
Not automatically. The facts must be assessed against section 22, including whether there are reasonable grounds to believe that personal information was accessed or acquired by an unauthorised person. Other contractual reporting duties may also apply.
POPIA requires notification as soon as reasonably possible after discovery, subject to the Act’s qualifications. It does not impose a blanket 72-hour period. Acting promptly and documenting your decisions is important.
An operator must promptly alert the responsible party when the statutory grounds arise. The responsible party remains accountable for its POPIA notification obligations. Contract terms and the incident facts should be reviewed.
Often the response develops in stages. The Information Regulator advises reporting as soon as reasonably practicable based on available facts and updating notifications as further information emerges.
Potentially. Exposure depends on the circumstances, the information affected, applicable contracts, duties and whether loss was caused. Prompt mitigation and careful record-keeping matter.
We help businesses take clear, proportionate legal steps following a security compromise, including POPIA notifications and practical response planning.
Related guidance: POPIA Compliance · Data & Privacy
This page is general information and not legal advice.
Please complete the following form to get in touch with us.
"*" indicates required fields
