A laptop is stolen, a mailbox is hijacked, or ransomware locks a server full of client records. Once personal information may have been accessed by someone who shouldn’t have it, the Protection of Personal Information Act (POPIA) puts specific duties on your business. Here is what they are, and how to handle the first days.
What counts as a security compromise?
Section 22 of POPIA applies when there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. You don’t need proof that data was stolen. Reasonable grounds are enough.
Who must you notify?
- The Information Regulator. Notifications are submitted through the Regulator’s online eServices portal.
- The people affected (data subjects), unless their identity can’t be established.
Both must be notified as soon as reasonably possible after you discover the compromise. Notice to data subjects may be delayed only if a public body responsible for preventing, detecting or investigating offences, or the Regulator, decides that notification would impede a criminal investigation.
If an operator, such as an IT provider, payroll bureau or cloud service, processes personal information for you, POPIA requires it to tell you immediately when it suspects a compromise. Check that your contracts say so.
What must the notice to data subjects contain?
The notice must be in writing (for example by email, post, on your website or in the news media, or as the Regulator directs) and give enough information for people to protect themselves, including:
- a description of the possible consequences of the compromise;
- what you have done, or plan to do, to address it;
- what the person can do to reduce the risk, such as changing passwords or watching for fraud; and
- the identity of the unauthorised person, if you know it.
The first 72 hours: a practical sequence
- Contain. Isolate affected devices, reset compromised accounts and preserve logs. Don’t wipe systems before evidence is collected.
- Assess. Work out what information was involved, how many people are affected and how sensitive the data is (ID numbers, banking details, health information and children’s information carry higher risk).
- Decide and document. Record what happened, when you discovered it and the decisions you made. The Regulator may ask.
- Notify. Submit the notification to the Regulator and send clear notices to the people affected.
- Fix the cause. Close the gap that let the attacker in, and test that the fix works.
Other obligations to check
If you are regulated by the FSCA or the Prudential Authority, Joint Standard 2 also requires you to report material cyber incidents to the regulator within 24 hours. Listed companies may have disclosure duties too. Our compliance services page summarises the recent laws.
Use our free POPIA breach response checklist to work through these steps and print a copy for your incident file.
Be ready before it happens
The businesses that handle a breach well are the ones that planned for it: an incident response plan, contact details for the Regulator and key suppliers, templates for notices, and backups that have been tested. iCloudz helps South African businesses prepare, respond and report. Talk to us before you need to.
This article is general information, not legal advice. For advice on a specific incident, consult your legal adviser.