POPIA Breach Response Checklist: What to Do After a Data Breach

What to do after a data breach

What to do, step by step, when personal information may have been compromised. Tick items off as you go and print a copy for your incident file.

POPIA section 225 phases · 22 stepsFree · no sign-up

0 of 0 steps done ·

The rule in short: if there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, you must notify the Information Regulator and the people affected as soon as reasonably possible after discovery (POPIA section 22). Notifications to the Regulator are made on its eServices portal.

1. Contain

First hours

Record the date and time the incident was discovered, and by whomThe “as soon as reasonably possible” clock is judged from discovery. Isolate affected devices or systems from the network Reset passwords and revoke sessions for compromised accounts, and enforce MFA Preserve evidence: keep logs, emails and disk images; don’t wipe or rebuild yet Activate your incident response team and keep a written log of actions and decisions

2. Assess

Day 1

Identify what personal information was involvedID numbers, banking details, health, children’s and special personal information carry higher risk. Estimate how many people are affected and whether you can identify them Establish how it happened and whether the attacker still has access Check whether an operator (IT provider, payroll bureau, cloud service) is involved, and get its reportOperators must tell you immediately when they suspect a compromise. Assess the likely consequences for the people affected (fraud, identity theft, harm)

3. Notify

As soon as reasonably possible

Submit the security compromise notification to the Information Regulator on its eServices portal Notify affected people in writing: email, post, a prominent website notice or news media, or as the Regulator directs Include: possible consequences, what you have done or will do, what they should do to protect themselves, and the identity of the unauthorised person if known If the police or the Regulator say notifying people would impede a criminal investigation, record that instructionOnly these bodies can justify delaying notice to the people affected. Open a criminal case with SAPS where a crime was committed (for example hacking or theft)

4. Other obligations

Check in parallel

FSCA or Prudential Authority regulated? Report material cyber incidents within 24 hours under Joint Standard 2 Tell your cyber insurer within the policy’s notice period Check contracts with clients and partners for breach-notification clauses

5. Recover and learn

Following weeks

Fix the root cause and test that the fix works Restore systems from clean, tested backups Hold a lessons-learned review and update your incident response plan and training Keep the incident file: timeline, evidence, notifications sent and decisions made

Dealing with an incident now?

iCloudz helps South African businesses contain incidents, prepare POPIA notifications and stop it happening again.

Call 082 759 5457 Send us a message Our compliance services

General information based on section 22 of the Protection of Personal Information Act 4 of 2013, not legal advice. Your ticks are saved only in this browser. Last reviewed October 2026.