South African Cyber Law
Security Safeguards and Data Breaches
POPIA places obligations on responsible parties to secure personal information and contains specific rules for security compromises.
Security safeguards
POPIA requires responsible parties to secure the integrity and confidentiality of personal information in their possession or under their control by taking appropriate, reasonable technical and organisational measures.
The safeguards should address the risks associated with loss, damage, unauthorised access and other forms of unlawful processing.
When a security compromise happens
Section 22 deals with notification following a security compromise.
Where the statutory requirements are triggered, the responsible party must notify the Information Regulator and the affected data subject or subjects as prescribed by the Act.
What individuals should do
If you are told that your information was involved in a security compromise, identify what information was affected and follow the organisation’s instructions carefully.
Change compromised passwords where appropriate, especially if a password was reused elsewhere.
Watch for follow-up phishing attempts. Information exposed in one incident can be used to make later scams more convincing.
What organisations should do
Incident response should establish what happened, what information was affected, what containment measures were taken and what notifications are required.
Technical remediation and legal notification are related but separate parts of an incident-response process.
Official source
Read the official legislation from the South African government:
Protection of Personal Information Act 4 of 2013 — South African Department of JusticeImportant
Cyber Conduct provides general educational information, not legal advice. South African legislation can change, and the application of the law depends on the facts of each situation. For a specific legal matter, consider obtaining advice from a qualified legal professional or the relevant authority.