Data breach response in South Africa: a step-by-step guide
A good data breach response in South Africa does two things at once: it stops the damage, and it meets your legal duties under POPIA. What you do in the first hours matters most. Use this guide as a checklist, and ideally read it before you need it.
Step 1: Activate your response team
Bring the right people together quickly: your IT lead or IT provider, a member of management with authority to make decisions, your Information Officer, and, where relevant, your legal adviser and cyber insurer. Many cyber insurance policies require you to notify the insurer early and to use approved responders, so check your policy before you appoint anyone.
Step 2: Contain the breach
- Disconnect affected computers from the network, but do not switch them off. Powering down can destroy evidence held in memory.
- Disable or reset compromised accounts and force sign-out of active sessions.
- Change passwords for administrator and service accounts that may be exposed.
- Block suspicious IP addresses, email senders and remote access paths.
Step 3: Preserve the evidence
Keep logs, suspicious emails, screenshots and any messages from attackers. Do not wipe or rebuild machines until the evidence has been captured. Start a written timeline straight away: what was noticed, when, by whom, and every action taken. You will need it for the Regulator, your insurer and any criminal case.
Step 4: Work out what was affected
Establish which systems were accessed, what personal information they held, whose information it was, roughly how many people are affected, and whether the attacker still has access. This assessment drives everything that follows, including who you must notify.
Step 5: Notify the Information Regulator and affected people
Under section 22 of POPIA, if there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, you must notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovering it. Notifications to the Regulator are submitted through its online eServices portal.
The notice to affected people must be in writing and must include enough information for them to protect themselves, including:
- a description of the possible consequences of the breach
- the measures you have taken or intend to take
- what they should do to reduce the risk, such as changing passwords or watching for fraud
- the identity of the unauthorised person, if known
If you process personal information on behalf of another organisation, POPIA requires you to tell that organisation immediately, so that it can meet its own obligations.
Other notifications to consider: your bank, if payments or banking details are involved; the police, if you want to open a criminal case; and your clients or partners, if your contracts require it. Some sectors also have their own reporting rules, including duties under the Cybercrimes Act for electronic communications service providers and financial institutions. Check with your legal adviser which apply to you.
Step 6: Recover safely
Close the hole the attacker used before you restore anything, whether it was a stolen password, an unpatched system or a phishing email. Restore from clean, tested backups, then watch closely for signs that the attacker is trying to get back in.
Step 7: Learn and improve
Once the dust settles, review what happened, how quickly it was detected and what slowed the response. Update your controls, your incident response plan and your staff training. Regulators, insurers and auditors will all want to see that the lessons were acted on.
Prepare before a breach happens
- Write a short incident response plan with names and phone numbers
- Know who your Information Officer is and make sure they are registered
- Keep tested backups, with at least one copy offline or immutable
- Collect security logs centrally so there is evidence to investigate
- Have 24/7 monitoring, so breaches are found in hours rather than weeks
- Check your cyber insurance notification requirements
This page is general guidance, not legal advice. For official guidance on reporting security compromises, visit the Information Regulator’s website, and speak to your legal adviser about your specific obligations.
Frequently asked questions
Do I have to report every data breach under POPIA?
You must notify the Information Regulator and affected people whenever there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person. If no personal information was involved, POPIA notification may not apply, but other obligations might.
How quickly must a breach be reported in South Africa?
POPIA requires notification as soon as reasonably possible after the breach is discovered, taking into account the time needed to determine its scope and restore the integrity of your systems.
Should I switch off infected computers?
No. Disconnect them from the network instead. Switching them off can destroy evidence that investigators need to understand what happened.
Do I need to report a data breach to the police?
Reporting to the police is generally your choice, and it is often worthwhile, especially where fraud or extortion is involved. Some sectors have additional reporting duties, so check with your legal adviser.
Need help with a breach, or want to be ready for one?
We help businesses contain incidents, gather the facts for POPIA notifications, and put monitoring in place so the next one is caught early. Call 021 001 0009 or email sales@acorntelecoms.co.za.
Talk to us about incident response
Somerset West, Western Cape, South Africa — serving clients nationally.