What to do after a data breach under POPIA

If personal information your business holds has been accessed or acquired by someone who should not have it, section 22 of the Protection of Personal Information Act 4 of 2013 (POPIA) requires you to notify the Information Regulator and the affected people as soon as reasonably possible after you discover it. The notice must be in writing and must give people enough detail to protect themselves. POPIA calls this a security compromise.

There is no small business exemption and no "it was only a few records" exemption. This guide takes you from the moment you discover the problem through containment, notification, and the paperwork that protects you afterwards.

What counts as a security compromise

A security compromise happens when there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. Examples that are easy to miss:

• a laptop or phone with customer records is stolen or lost
• an email with a client list is sent to the wrong recipient
• a staff member's login is phished and used to read the mailbox
• ransomware locks your files, and attackers usually copy them first
• a former employee still has access to the shared drive and downloads it
• a supplier or platform that processes information for you, an operator in POPIA language, reports a breach on its side
• a paper file goes missing from the office

The duty is triggered by reasonable grounds to believe. You do not need proof. If you think it probably happened, the clock is running.

If the breach happened at an operator, the operator must tell you immediately, and the duty to notify the Regulator and the affected people is yours as the responsible party.

Step one: contain it

Before you write to anyone, stop the bleeding.

1. Change passwords on the affected accounts and on anything that shares a password with them.
2. Revoke access for the account, device or person involved. Remotely wipe a lost device if you can.
3. Disconnect infected machines from the network and do not pay a ransom without advice.
4. Preserve evidence. Do not delete logs, emails or the phishing message.
5. Write down the timeline as you go: when you noticed, what you saw, what you did.

Step two: work out what was taken

You need to be able to say, in writing, what information was involved and whose. Go through:

• Which systems or files were affected.
• What fields they contained: names only, or names with ID numbers, bank details, health information or passwords.
• How many people, and who. Customers, staff, suppliers, job applicants.
• Whether any of it was special personal information (health, biometrics, race, religion, sexual life, criminal behaviour, trade union membership, political persuasion) or children's information, which raises the stakes for the people affected.
• Whether the information was encrypted in a way that means the attacker cannot read it.

This step decides what goes in the letters. If you do not yet know everything, notify what you know and update later.

Step three: notify the Information Regulator

The Regulator publishes a security compromise notification form on its website. Use it. The form asks for a description of the incident, when it happened and when you discovered it, the categories and approximate number of people affected, the type of information, the measures you have taken or plan to take, and whether you have told the affected people. Submit it as soon as reasonably possible. Do not wait until your investigation is complete; send what you have and supplement it.

If the police are involved, or the Regulator itself asks you to delay notifying the affected people so as not to prejudice an investigation, that delay is permitted. It must be a genuine investigative reason, not convenience.

Step four: notify the affected people

Section 22 requires the notice to affected people to be in writing and to reach them in at least one of these ways: by post to their last known physical or postal address, by email to their last known email address, by prominent placement on your website, by publication in the news media, or as the Regulator directs. Where you can reach people directly, do it. A website notice alone is for the people you cannot identify or reach.

The notice must contain enough information to allow the person to take protective measures. That means, at minimum:

• what happened, in plain language
• what information about them was involved
• what you have done about it
• what they can do to protect themselves, for example changing passwords, watching bank statements, or being alert to phishing that uses the stolen details
• if you know who took it, the identity of that person or body, so far as you can say
• how to contact your Information Officer with questions

Keep it short and honest.

Illustrative example: an online craft shop

The example is illustrative only.

Lerato runs an online shop selling handmade homeware from Soweto. Her store platform is an operator. On a Monday morning the platform emails her: an attacker accessed the customer export function on Friday night and downloaded her customer list, about 2 300 names, email addresses, delivery addresses and phone numbers. No card details were stored on the platform, and no passwords.

Lerato changes her platform password and switches on two-factor authentication before she finishes her coffee. She writes a timeline. By lunchtime she has completed the Regulator's form, listing about 2 300 South African customers, the fields involved, the fact that the platform is an operator and the steps taken. That afternoon she emails all 2 300 customers: what happened, what was taken, that no card details or passwords were involved, that they should be alert to delivery scams and phishing that quote their real address, and how to reach her. She posts the same notice on her website. She logs every customer reply.

Total cost: a day of her time and some awkward emails. Had she sat on it, a customer complaint would have brought an investigation, an enforcement notice, and every customer finding out from the news.

What to do this week

1. Contain the breach and preserve evidence.
2. Record a timeline of discovery and response.
3. Establish the scope: what, how many, whose, and whether special or children's information is involved.
4. Submit the Regulator's security compromise form with what you know.
5. Write to the affected people by the most direct method available.
6. Log every response you receive and answer questions promptly.
7. Fix the root cause: the missing two-factor authentication, the stale user account, the unencrypted laptop.
8. Tell your insurer if you have cyber or business cover.

Documents and records to set up

• A breach response plan of one or two pages, written before you need it: who does what, where the Regulator's form is, template wording for customer notices, and contact details for your operators and IT support.
• A breach register recording every incident, even small ones you decide are not notifiable, with your reasoning.
• Copies of the Regulator notification and every notice sent to affected people.
• An operator agreement with each supplier that requires them to notify you immediately of any compromise on their side.
• Proof of the security fixes made afterwards, in case the Regulator asks.

Realistic timeline

• Hour one: containment and evidence preservation.
• Day one: scope established, Regulator notified with what is known, direct notices drafted.
• Days one to three: notices sent to affected people, website notice up.
• Weeks one to four: Regulator queries answered, root cause fixed, register updated.
• Months one to six: possible follow-up from the Regulator, particularly if complaints are received.

"As soon as reasonably possible" is not defined in days. A small business with a clear picture of what happened should aim to have both notices out within a few days of discovery. A longer delay must be justifiable by a real need to establish the facts or by a police or Regulator request.

Common mistakes and what they cost

• Waiting until you know everything. The duty is to notify when there are reasonable grounds to believe a compromise happened. You can update later. Delay is what the Regulator penalises.
• Notifying the Regulator but not the people. Both are required. The people affected are the ones who can protect themselves, and the ones who complain.
• A vague notice. "We experienced a security incident" tells people nothing. The notice must give enough detail for them to act.
• Deleting evidence while trying to clean up. It looks like a cover-up and makes it impossible to establish the scope.
• Assuming the operator will handle it. The operator must tell you. The notification duty is yours.
• No breach plan. The businesses that handle breaches well are the ones that wrote a page of instructions when nothing was wrong.

The cost of getting this wrong runs from an enforcement notice, through administrative fines imposed by the Regulator, to civil claims by affected people, who may claim damages whether or not you intended harm. Fine amounts are set by law and change. Failing to comply with an enforcement notice is an offence. See what small business and POPIA compliance costs.

If you cannot afford an attorney

The Regulator's security compromise form and its guidance are free, and its staff answer questions about the form. The Small Enterprise Development Agency (Seda) can help with the business recovery side. University law clinics assist small businesses with notification wording. If the breach was caused by a supplier who then refuses to refund or compensate you, the Small Claims Court hears money claims up to its limit without attorneys. Legal Aid South Africa serves individuals rather than businesses. Speak to an attorney if the breach involves special personal information, a large number of people, or a likely claim.

Frequently asked questions

Do I have to notify if I am not sure a breach happened? The duty is triggered by reasonable grounds to believe that information was accessed or acquired without authorisation. If you would bet that it happened, notify. Record your reasoning either way.

Can I notify by SMS or WhatsApp? Section 22 lists post, email, website placement, news media and any method the Regulator directs. A direct written message is in the spirit of the section, but send an email or letter as well and keep proof.

Can the affected people sue me? POPIA allows a person to claim damages from a responsible party for a breach of the Act, and the Regulator can also bring a claim on their behalf. Prompt, honest notification is your best mitigation.

Should I report it to the police? Theft, hacking and fraud are crimes. Report them, get a case number and note it in the Regulator form.