What triggers the duty?
Section 22(1): where there are reasonable grounds to believe that personal information “has been accessed or acquired by any unauthorised person”, you must notify the Regulator and the affected data subjects (unless their identity cannot be established). Note the threshold — reasonable grounds to believe, not forensic certainty. The hacked mailbox, the stolen laptop, the misdirected bulk email, the rogue employee in the CRM: each crosses it. Your operators must tell you immediately (s 21(2)) — their discovery starts your analysis.
The clock: as soon as reasonably possible
“as soon as reasonably possible after the discovery of the compromise”
Note — The only permitted delays: legitimate needs of law enforcement, and measures reasonably necessary to determine the scope of the compromise and restore your systems’ integrity. POPIA has no 72-hour rule like the GDPR — “as soon as reasonably possible” can be sooner.
And the Regulator has killed the wait-for-forensics instinct in terms: “an investigation into a security compromise does not need to be completed before it is reported... report the security compromise as soon as reasonably practicable based on the information at hand, and then... update the notification as further information comes to light.”
The eServices portal — and the no-threshold rule
Two 2025 developments hardened the practicalities:
“as of 01 April 2025, is mandatory for all organisations to report any security compromises using the portal, rather than via email”
“POPIA does not have a threshold for reporting of security compromises. All security compromises must be reported by the responsible party irrespective of the deemed level of risk.”
Practical upshot: register on the eServices portal before you need it (your information officer needs portal credentials anyway), and strike “too small to report” from the incident playbook.
What the notification must say
Section 22(5): enough to let data subjects protect themselves against the potential consequences — including a description of the possible consequences, the measures you have taken or will take, the steps you recommend they take (change passwords, watch accounts, fraud alerts), and the identity of the intruder if known. Write it for the reader, not the lawyer: the notification’s legal function is enabling protective action.
The breach plan to have ready
- Who decides: the information officer + escalation chain, named, with after-hours contacts
- eServices portal access: registered, credentials current, tested
- Operator notification clauses in place (s 21(2)) — their "immediately" feeds your clock
- Draft data-subject notice on file: consequences / measures / recommended steps / contact point
- Containment-vs-notification discipline: contain and scope, but never let forensics delay the report
- Log everything — discovery time, decisions, notifications — the record is your defence
Failure to notify is itself a breach that features in nearly every enforcement notice to date — Dis-Chem, SAPS, TransUnion, the IEC, Lancet Laboratories. Lancet’s R100 000 fine (paid) grew specifically from repeated unreported compromises. See the enforcement tracker.